diff --git a/console/src/app.tsx b/console/src/app.tsx
index 99c171d5..5593f622 100644
--- a/console/src/app.tsx
+++ b/console/src/app.tsx
@@ -6,6 +6,7 @@ import { PerformancePage } from "@/pages/performance"
 import { TrafficPage } from "@/pages/traffic"
 import { ErrorsPage } from "@/pages/errors"
 import { ModelsPage } from "@/pages/models"
+import { ServicesPage } from "@/pages/services"
 import { LlmCallsPage } from "@/pages/llm-calls"
 import { AgentSessionsPage } from "@/pages/agent-sessions"
 import { AgentSessionDetailPage } from "@/pages/agent-session-detail"
@@ -36,6 +37,7 @@ export default function App() {
             <Route path="/traffic" element={<TrafficPage />} />
             <Route path="/errors" element={<ErrorsPage />} />
             <Route path="/models" element={<ModelsPage />} />
+            <Route path="/services" element={<ServicesPage />} />
             <Route path="/agent-sessions" element={<AgentSessionsPage />} />
             <Route path="/agent-sessions/:source_id/:session_id" element={<AgentSessionDetailPage />} />
             <Route path="/agent-turns" element={<AgentTurnsPage />} />
diff --git a/console/src/components/charts/agent-activity-chart.tsx b/console/src/components/charts/agent-activity-chart.tsx
new file mode 100644
index 00000000..904d0611
--- /dev/null
+++ b/console/src/components/charts/agent-activity-chart.tsx
@@ -0,0 +1,115 @@
+import {
+  AreaChart,
+  Area,
+  XAxis,
+  YAxis,
+  CartesianGrid,
+  Tooltip,
+  ResponsiveContainer,
+  Legend,
+} from "recharts"
+import { formatNumber, formatAxisTime } from "@/lib/format"
+import type { AgentActivityPoint } from "@/types/api"
+
+// Same palette as RequestVolumeChart — keeps the Overview row
+// internally consistent.
+const SERIES_COLORS = [
+  "#3b82f6",
+  "#10b981",
+  "#f59e0b",
+  "#ef4444",
+  "#8b5cf6",
+  "#ec4899",
+  "#06b6d4",
+  "#84cc16",
+]
+
+interface Props {
+  points: AgentActivityPoint[]
+}
+
+export function AgentActivityChart({ points }: Props) {
+  if (points.length === 0) {
+    return (
+      <div className="flex h-[240px] items-center justify-center text-sm text-muted-foreground">
+        No agent activity in the selected window
+      </div>
+    )
+  }
+
+  // Pivot the long-form rows `(ts, kind, count)` into wide-form
+  // recharts data: `{time: <sec>, kind1: n, kind2: n, ...}`.
+  const tsSet = new Set<number>()
+  const kindSet = new Set<string>()
+  const byTsKind = new Map<number, Map<string, number>>()
+  for (const p of points) {
+    tsSet.add(p.timestamp_ms)
+    kindSet.add(p.agent_kind)
+    if (!byTsKind.has(p.timestamp_ms)) byTsKind.set(p.timestamp_ms, new Map())
+    byTsKind.get(p.timestamp_ms)!.set(p.agent_kind, p.turn_count)
+  }
+  const tsAsc = [...tsSet].sort((a, b) => a - b)
+  // Sort kinds by total turns desc so the dominant agent renders
+  // closest to the X axis — same convention as RequestVolumeChart.
+  const totals = new Map<string, number>()
+  for (const p of points) {
+    totals.set(p.agent_kind, (totals.get(p.agent_kind) ?? 0) + p.turn_count)
+  }
+  const kindsByVolume = [...kindSet].sort(
+    (a, b) => (totals.get(b) ?? 0) - (totals.get(a) ?? 0),
+  )
+  const chartData = tsAsc.map((ms) => {
+    const row: Record<string, number> = { time: Math.floor(ms / 1000) }
+    const m = byTsKind.get(ms)!
+    for (const k of kindsByVolume) {
+      row[k] = m.get(k) ?? 0
+    }
+    return row
+  })
+  const spanSec =
+    tsAsc.length > 1 ? (tsAsc[tsAsc.length - 1] - tsAsc[0]) / 1000 : 0
+
+  return (
+    <ResponsiveContainer width="100%" height={240}>
+      <AreaChart data={chartData} margin={{ top: 4, right: 8, bottom: 0, left: -12 }}>
+        <CartesianGrid strokeDasharray="3 3" className="stroke-border" />
+        <XAxis
+          dataKey="time"
+          tickFormatter={(v: number) => formatAxisTime(v, spanSec)}
+          className="text-[11px] fill-muted-foreground"
+          tickLine={false}
+          axisLine={false}
+        />
+        <YAxis
+          tickFormatter={(v: number) => formatNumber(v)}
+          className="text-[11px] fill-muted-foreground"
+          tickLine={false}
+          axisLine={false}
+        />
+        <Tooltip
+          labelFormatter={(v) => new Date(Number(v) * 1000).toLocaleString()}
+          formatter={(value, name) => [formatNumber(Number(value)), String(name)]}
+          contentStyle={{
+            backgroundColor: "hsl(var(--card))",
+            borderColor: "hsl(var(--border))",
+            borderRadius: "8px",
+            fontSize: "12px",
+          }}
+        />
+        <Legend wrapperStyle={{ fontSize: "12px" }} />
+        {kindsByVolume.map((kind, i) => (
+          <Area
+            key={kind}
+            type="monotone"
+            dataKey={kind}
+            stackId="1"
+            fill={SERIES_COLORS[i % SERIES_COLORS.length]}
+            stroke={SERIES_COLORS[i % SERIES_COLORS.length]}
+            fillOpacity={0.4}
+            isAnimationActive={false}
+          />
+        ))}
+      </AreaChart>
+    </ResponsiveContainer>
+  )
+}
diff --git a/console/src/components/charts/agent-distribution-chart.tsx b/console/src/components/charts/agent-distribution-chart.tsx
new file mode 100644
index 00000000..951d7b98
--- /dev/null
+++ b/console/src/components/charts/agent-distribution-chart.tsx
@@ -0,0 +1,88 @@
+import {
+  BarChart,
+  Bar,
+  XAxis,
+  YAxis,
+  CartesianGrid,
+  Tooltip,
+  ResponsiveContainer,
+} from "recharts"
+import { formatNumber } from "@/lib/format"
+import type { AgentKindSummary } from "@/types/api"
+
+interface Props {
+  rows: AgentKindSummary[]
+}
+
+export function AgentDistributionChart({ rows }: Props) {
+  if (rows.length === 0) {
+    return (
+      <div className="flex h-[240px] items-center justify-center text-sm text-muted-foreground">
+        No agents observed in the selected window
+      </div>
+    )
+  }
+
+  // Trim to top 10 — agent_kind cardinality is usually <10 anyway,
+  // but a misconfigured client can dump dozens of arbitrary strings.
+  const sorted = [...rows].sort((a, b) => b.turn_count - a.turn_count).slice(0, 10)
+  const chartData = sorted.map((r) => ({
+    label: r.agent_kind.length > 24 ? r.agent_kind.slice(0, 22) + "…" : r.agent_kind,
+    full: r.agent_kind,
+    turns: r.turn_count,
+    in: r.total_input_tokens,
+    out: r.total_output_tokens,
+  }))
+
+  return (
+    <ResponsiveContainer
+      width="100%"
+      height={Math.max(240, sorted.length * 36 + 40)}
+    >
+      <BarChart
+        data={chartData}
+        layout="vertical"
+        margin={{ top: 4, right: 8, bottom: 0, left: 0 }}
+      >
+        <CartesianGrid strokeDasharray="3 3" horizontal={false} className="stroke-border" />
+        <XAxis
+          type="number"
+          tickFormatter={(v: number) => formatNumber(v)}
+          className="text-[11px] fill-muted-foreground"
+          tickLine={false}
+          axisLine={false}
+        />
+        <YAxis
+          type="category"
+          dataKey="label"
+          width={150}
+          className="text-[11px] fill-muted-foreground"
+          tickLine={false}
+          axisLine={false}
+        />
+        <Tooltip
+          formatter={(value, name) => {
+            if (name === "turns") return [formatNumber(Number(value)), "Turns"]
+            return [String(value), String(name)]
+          }}
+          labelFormatter={(_label, payload) =>
+            (payload[0]?.payload as Record<string, string>)?.full ?? String(_label)
+          }
+          contentStyle={{
+            backgroundColor: "hsl(var(--card))",
+            borderColor: "hsl(var(--border))",
+            borderRadius: "8px",
+            fontSize: "12px",
+          }}
+        />
+        <Bar
+          dataKey="turns"
+          fill="#8b5cf6"
+          radius={[0, 4, 4, 0]}
+          barSize={20}
+          isAnimationActive={false}
+        />
+      </BarChart>
+    </ResponsiveContainer>
+  )
+}
diff --git a/console/src/components/layout/sidebar.tsx b/console/src/components/layout/sidebar.tsx
index ea1123c7..b56712ad 100644
--- a/console/src/components/layout/sidebar.tsx
+++ b/console/src/components/layout/sidebar.tsx
@@ -4,7 +4,7 @@ import {
   Gauge,
   BarChart3,
   AlertTriangle,
-  Cpu,
+  Server,
   Sparkles,
   MessageSquare,
   MessagesSquare,
@@ -22,9 +22,11 @@ const TOOLBAR_KEYS = ["preset", "start", "end", "wire_api", "model", "server_ip"
 const navItems = [
   { to: "/", icon: LayoutDashboard, label: "Overview" },
   { to: "/performance", icon: Gauge, label: "Performance" },
-  { to: "/traffic", icon: BarChart3, label: "Traffic" },
+  // Models view is now a tab inside Services; route /models still
+  // resolves for shared links but the sidebar entry was redundant.
+  { to: "/traffic", icon: BarChart3, label: "Usage" },
   { to: "/errors", icon: AlertTriangle, label: "Errors" },
-  { to: "/models", icon: Cpu, label: "Models" },
+  { to: "/services", icon: Server, label: "Services" },
   { to: "/agent-sessions", icon: MessageSquare, label: "Agent Sessions" },
   { to: "/agent-turns", icon: MessagesSquare, label: "Agent Turns" },
   { to: "/llm-calls", icon: Sparkles, label: "LLM Calls" },
diff --git a/console/src/components/services/path-view.tsx b/console/src/components/services/path-view.tsx
new file mode 100644
index 00000000..c4c20898
--- /dev/null
+++ b/console/src/components/services/path-view.tsx
@@ -0,0 +1,367 @@
+import { useMemo } from "react"
+import { Users } from "lucide-react"
+import { cn } from "@/lib/utils"
+import { formatNumber } from "@/lib/format"
+import type { ServicesTopology, TopologyNode } from "@/types/api"
+
+const APP_NODE_STYLE: Record<string, string> = {
+  vllm: "border-purple-400 bg-purple-50 dark:bg-purple-950/40",
+  sglang: "border-cyan-400 bg-cyan-50 dark:bg-cyan-950/40",
+  ollama: "border-amber-400 bg-amber-50 dark:bg-amber-950/40",
+  llamacpp: "border-emerald-400 bg-emerald-50 dark:bg-emerald-950/40",
+  litellm: "border-pink-400 bg-pink-50 dark:bg-pink-950/40",
+  openai: "border-green-400 bg-green-50 dark:bg-green-950/40",
+  anthropic: "border-orange-400 bg-orange-50 dark:bg-orange-950/40",
+  gemini: "border-blue-400 bg-blue-50 dark:bg-blue-950/40",
+  clients: "border-slate-400 bg-slate-100 dark:bg-slate-800/60",
+}
+
+const APP_BADGE_STYLE: Record<string, string> = {
+  vllm: "bg-purple-100 text-purple-800 dark:bg-purple-900/40 dark:text-purple-300",
+  sglang: "bg-cyan-100 text-cyan-800 dark:bg-cyan-900/40 dark:text-cyan-300",
+  ollama: "bg-amber-100 text-amber-800 dark:bg-amber-900/40 dark:text-amber-300",
+  llamacpp: "bg-emerald-100 text-emerald-800 dark:bg-emerald-900/40 dark:text-emerald-300",
+  litellm: "bg-pink-100 text-pink-800 dark:bg-pink-900/40 dark:text-pink-300",
+  openai: "bg-green-100 text-green-800 dark:bg-green-900/40 dark:text-green-300",
+  anthropic: "bg-orange-100 text-orange-800 dark:bg-orange-900/40 dark:text-orange-300",
+  gemini: "bg-blue-100 text-blue-800 dark:bg-blue-900/40 dark:text-blue-300",
+}
+
+const CLIENTS_ID = "__clients__:0"
+const NODE_W = 200
+const NODE_H = 80
+const COL_GAP = 120
+const ROW_GAP = 24
+const SVG_PAD = 24
+
+function nodeId(ip: string, port: number): string {
+  return `${ip}:${port}`
+}
+
+interface LayoutNode extends TopologyNode {
+  id: string
+  col: number
+  row: number
+  x: number
+  y: number
+}
+
+interface LayoutEdge {
+  from: string
+  to: string
+  kind: "proxy" | "inferred" | "client"
+  turn_count: number
+}
+
+/// BFS from the clients node assigns each service to a depth column.
+/// Services not reachable from clients (e.g. an isolated proxy_out
+/// without observed proxy_in this window) get appended to the last
+/// column so they still render somewhere. Sibling order within a
+/// column is stable by `call_count` desc for visual predictability.
+function layoutGraph(topology: ServicesTopology) {
+  const nodesById = new Map<string, TopologyNode>()
+  for (const n of topology.nodes) {
+    nodesById.set(nodeId(n.server_ip, n.server_port), n)
+  }
+  const adj = new Map<string, string[]>()
+  for (const e of topology.edges) {
+    const from = nodeId(e.from_ip, e.from_port)
+    const to = nodeId(e.to_ip, e.to_port)
+    if (!adj.has(from)) adj.set(from, [])
+    adj.get(from)!.push(to)
+  }
+
+  const colOf = new Map<string, number>()
+  const queue: Array<{ id: string; col: number }> = []
+  if (nodesById.has(CLIENTS_ID)) {
+    queue.push({ id: CLIENTS_ID, col: 0 })
+    colOf.set(CLIENTS_ID, 0)
+  }
+  while (queue.length > 0) {
+    const { id, col } = queue.shift()!
+    const neighbors = adj.get(id) ?? []
+    for (const nb of neighbors) {
+      if (!nodesById.has(nb)) continue
+      const existing = colOf.get(nb)
+      // Keep the LARGEST depth so a node always sits to the right of
+      // any predecessor we've actually seen — matters for the
+      // 3-leg haproxy case where clients → A → B AND clients → B
+      // both exist and B should still render to the right of A.
+      if (existing === undefined || col + 1 > existing) {
+        colOf.set(nb, col + 1)
+        queue.push({ id: nb, col: col + 1 })
+      }
+    }
+  }
+
+  // Place stragglers (no incoming edge from clients) into the
+  // rightmost discovered column + 1 so they render but don't overlap.
+  let maxCol = 0
+  for (const c of colOf.values()) maxCol = Math.max(maxCol, c)
+  for (const id of nodesById.keys()) {
+    if (!colOf.has(id)) colOf.set(id, maxCol + 1)
+  }
+
+  // Group by column, sort within by call_count desc.
+  const cols: LayoutNode[][] = []
+  for (const [id, n] of nodesById) {
+    const c = colOf.get(id) ?? 0
+    if (!cols[c]) cols[c] = []
+    cols[c].push({
+      ...n,
+      id,
+      col: c,
+      row: 0, // assigned below
+      x: 0,
+      y: 0,
+    })
+  }
+  for (const colNodes of cols) {
+    if (!colNodes) continue
+    colNodes.sort((a, b) => b.call_count - a.call_count)
+    colNodes.forEach((n, i) => {
+      n.row = i
+    })
+  }
+
+  const colCount = cols.length
+  // Center each column vertically so columns of unequal length don't
+  // visually drift to the top — easier to scan upstream/downstream.
+  const maxRows = Math.max(1, ...cols.filter(Boolean).map((c) => c.length))
+  const totalH = maxRows * NODE_H + (maxRows - 1) * ROW_GAP + 2 * SVG_PAD
+  const totalW = colCount * NODE_W + (colCount - 1) * COL_GAP + 2 * SVG_PAD
+
+  const placed: LayoutNode[] = []
+  for (let c = 0; c < cols.length; c++) {
+    const colNodes = cols[c]
+    if (!colNodes) continue
+    const colH = colNodes.length * NODE_H + (colNodes.length - 1) * ROW_GAP
+    const startY = SVG_PAD + (totalH - 2 * SVG_PAD - colH) / 2
+    for (const n of colNodes) {
+      n.x = SVG_PAD + c * (NODE_W + COL_GAP)
+      n.y = startY + n.row * (NODE_H + ROW_GAP)
+      placed.push(n)
+    }
+  }
+
+  const edges: LayoutEdge[] = topology.edges.map((e) => ({
+    from: nodeId(e.from_ip, e.from_port),
+    to: nodeId(e.to_ip, e.to_port),
+    kind: e.kind,
+    turn_count: e.turn_count,
+  }))
+
+  return { placed, edges, totalW, totalH }
+}
+
+function NodeCard({ n }: { n: LayoutNode }) {
+  const app = n.app ?? "unknown"
+  const isClients = n.server_ip === "__clients__"
+  const wrapCls =
+    APP_NODE_STYLE[app] ?? "border-slate-300 bg-card"
+  const badgeCls =
+    APP_BADGE_STYLE[app] ??
+    "bg-muted text-muted-foreground"
+  const topModels = n.models.slice(0, 2)
+  return (
+    <div
+      className={cn(
+        "flex h-full w-full flex-col gap-1 rounded-lg border-2 px-2.5 py-1.5 shadow-sm",
+        wrapCls,
+      )}
+      title={
+        isClients
+          ? `Aggregated client traffic — ${formatNumber(n.call_count)} inbound turn-endpoints`
+          : n.models.length > 0
+            ? `Models: ${n.models.join(", ")}`
+            : undefined
+      }
+    >
+      <div className="flex items-center gap-1.5">
+        {isClients ? <Users className="size-3.5 shrink-0" /> : null}
+        <span
+          className={cn(
+            "rounded px-1.5 py-0.5 text-[10px] font-medium",
+            isClients ? "bg-slate-200 text-slate-700 dark:bg-slate-700 dark:text-slate-100" : badgeCls,
+          )}
+        >
+          {app}
+        </span>
+        <span className="ml-auto text-[10px] tabular-nums text-muted-foreground">
+          {formatNumber(n.call_count)}
+        </span>
+      </div>
+      {!isClients && (
+        <div className="truncate font-mono text-[11px] font-medium">
+          {n.server_ip}:{n.server_port}
+        </div>
+      )}
+      {!isClients && topModels.length > 0 && (
+        <div className="truncate text-[10px] text-muted-foreground" title={n.models.join(", ")}>
+          {topModels.join(", ")}
+          {n.models.length > topModels.length ? ` +${n.models.length - topModels.length}` : ""}
+        </div>
+      )}
+      {isClients && (
+        <div className="text-[10px] text-muted-foreground">all upstream callers</div>
+      )}
+    </div>
+  )
+}
+
+export function ServicePathView({ topology }: { topology: ServicesTopology }) {
+  const layout = useMemo(() => layoutGraph(topology), [topology])
+  const { placed, edges, totalW, totalH } = layout
+
+  if (placed.length === 0) {
+    return (
+      <div className="flex h-[400px] items-center justify-center text-sm text-muted-foreground">
+        No services observed in selected time range
+      </div>
+    )
+  }
+
+  const posById = new Map<string, LayoutNode>()
+  for (const n of placed) posById.set(n.id, n)
+
+  // Scale edge stroke width by turn_count relative to the max so the
+  // hottest path stands out without making low-volume edges invisible.
+  const maxCount = Math.max(1, ...edges.map((e) => e.turn_count))
+  const strokeWidth = (count: number) => {
+    const norm = count / maxCount
+    return Math.max(1.2, Math.min(6, 1.2 + norm * 4.8))
+  }
+
+  return (
+    <div className="relative w-full overflow-auto">
+      <svg
+        width={totalW}
+        height={totalH}
+        style={{ minWidth: totalW, minHeight: totalH }}
+        className="block"
+      >
+        <defs>
+          <marker
+            id="arrow-proxy"
+            viewBox="0 0 10 10"
+            refX="9"
+            refY="5"
+            markerWidth="6"
+            markerHeight="6"
+            orient="auto-start-reverse"
+          >
+            <path d="M 0 0 L 10 5 L 0 10 z" className="fill-blue-500" />
+          </marker>
+          <marker
+            id="arrow-inferred"
+            viewBox="0 0 10 10"
+            refX="9"
+            refY="5"
+            markerWidth="6"
+            markerHeight="6"
+            orient="auto-start-reverse"
+          >
+            <path d="M 0 0 L 10 5 L 0 10 z" className="fill-blue-400" />
+          </marker>
+          <marker
+            id="arrow-client"
+            viewBox="0 0 10 10"
+            refX="9"
+            refY="5"
+            markerWidth="6"
+            markerHeight="6"
+            orient="auto-start-reverse"
+          >
+            <path d="M 0 0 L 10 5 L 0 10 z" className="fill-slate-400" />
+          </marker>
+        </defs>
+        {edges.map((e, idx) => {
+          const from = posById.get(e.from)
+          const to = posById.get(e.to)
+          if (!from || !to) return null
+          const x1 = from.x + NODE_W
+          const y1 = from.y + NODE_H / 2
+          const x2 = to.x
+          const y2 = to.y + NODE_H / 2
+          // Cubic bezier so the curve looks intentional rather than
+          // a straight diagonal that crosses every other node.
+          const cx1 = x1 + COL_GAP / 2
+          const cx2 = x2 - COL_GAP / 2
+          const d = `M ${x1} ${y1} C ${cx1} ${y1}, ${cx2} ${y2}, ${x2} ${y2}`
+          const colorCls =
+            e.kind === "proxy"
+              ? "stroke-blue-500"
+              : e.kind === "inferred"
+                ? "stroke-blue-400"
+                : "stroke-slate-400"
+          // Solid for pair-confirmed; short-dash for heuristic
+          // inferred edges (signals lower confidence); long-dash for
+          // anonymous clients.
+          const dash =
+            e.kind === "client" ? "4 4" : e.kind === "inferred" ? "6 3" : undefined
+          const marker =
+            e.kind === "proxy"
+              ? "arrow-proxy"
+              : e.kind === "inferred"
+                ? "arrow-inferred"
+                : "arrow-client"
+          return (
+            <g key={idx}>
+              <path
+                d={d}
+                fill="none"
+                className={colorCls}
+                strokeWidth={strokeWidth(e.turn_count)}
+                strokeDasharray={dash}
+                markerEnd={`url(#${marker})`}
+                opacity={0.75}
+              />
+              {/* Mid-edge label — show counts on real service→service
+                  hops (proxy + inferred). Skip on client edges since
+                  the aggregate already shows on the clients node. */}
+              {e.kind !== "client" && (
+                <text
+                  x={(x1 + x2) / 2}
+                  y={(y1 + y2) / 2 - 4}
+                  textAnchor="middle"
+                  className={cn(
+                    "text-[10px]",
+                    e.kind === "proxy"
+                      ? "fill-blue-700 dark:fill-blue-300"
+                      : "fill-blue-500 dark:fill-blue-400",
+                  )}
+                >
+                  {formatNumber(e.turn_count)}
+                </text>
+              )}
+            </g>
+          )
+        })}
+        {placed.map((n) => (
+          <foreignObject key={n.id} x={n.x} y={n.y} width={NODE_W} height={NODE_H}>
+            <NodeCard n={n} />
+          </foreignObject>
+        ))}
+      </svg>
+      <div className="sticky bottom-0 mt-2 flex flex-wrap items-center gap-4 border-t border-border bg-card px-3 py-2 text-[10px] text-muted-foreground">
+        <span className="inline-flex items-center gap-1">
+          <span className="inline-block h-0.5 w-4 bg-blue-500"></span>
+          proxy hop (pair-confirmed)
+        </span>
+        <span className="inline-flex items-center gap-1">
+          <svg width="20" height="2" className="overflow-visible">
+            <line x1="0" y1="1" x2="20" y2="1" className="stroke-blue-400" strokeWidth="1.5" strokeDasharray="6 3" />
+          </svg>
+          inferred (caller_ip = known service)
+        </span>
+        <span className="inline-flex items-center gap-1">
+          <svg width="20" height="2" className="overflow-visible">
+            <line x1="0" y1="1" x2="20" y2="1" className="stroke-slate-400" strokeWidth="1.5" strokeDasharray="4 4" />
+          </svg>
+          anonymous client
+        </span>
+        <span className="ml-auto">Edge width ∝ turn count</span>
+      </div>
+    </div>
+  )
+}
diff --git a/console/src/hooks/use-agent-overview.ts b/console/src/hooks/use-agent-overview.ts
new file mode 100644
index 00000000..0dcffe89
--- /dev/null
+++ b/console/src/hooks/use-agent-overview.ts
@@ -0,0 +1,26 @@
+import { useQuery } from "@tanstack/react-query"
+import { apiFetch } from "@/lib/api"
+import { useToolbarStore } from "@/stores/toolbar"
+import type { AgentActivityData, AgentSummaryData } from "@/types/api"
+
+export function useAgentSummary() {
+  const start = useToolbarStore((s) => s.start)
+  const end = useToolbarStore((s) => s.end)
+  return useQuery({
+    queryKey: ["agent-summary", { start, end }],
+    queryFn: () =>
+      apiFetch<AgentSummaryData>("/api/agent-turns/summary", { start, end }),
+    placeholderData: (prev) => prev,
+  })
+}
+
+export function useAgentActivity() {
+  const start = useToolbarStore((s) => s.start)
+  const end = useToolbarStore((s) => s.end)
+  return useQuery({
+    queryKey: ["agent-activity", { start, end }],
+    queryFn: () =>
+      apiFetch<AgentActivityData>("/api/agent-turns/activity", { start, end }),
+    placeholderData: (prev) => prev,
+  })
+}
diff --git a/console/src/hooks/use-agent-turns.ts b/console/src/hooks/use-agent-turns.ts
index db4c9256..d6fef3da 100644
--- a/console/src/hooks/use-agent-turns.ts
+++ b/console/src/hooks/use-agent-turns.ts
@@ -15,12 +15,14 @@ interface UseAgentTurnsParams {
   agentKind?: string
   /** CSV of client IPs e.g. "10.0.0.1,10.0.0.2" */
   clientIp?: string
+  /** CSV of u16 server ports e.g. "4210,9000" */
+  serverPort?: string
   /** When true, return turns the pair sweeper marked hidden
    * (`proxy_out` / `mirror_secondary`). Default false. */
   includeProxyHops?: boolean
 }
 
-export function useAgentTurns({ page, pageSize, sortBy, sortOrder, status, agentKind, clientIp, includeProxyHops }: UseAgentTurnsParams) {
+export function useAgentTurns({ page, pageSize, sortBy, sortOrder, status, agentKind, clientIp, serverPort, includeProxyHops }: UseAgentTurnsParams) {
   const start = useToolbarStore((s) => s.start)
   const end = useToolbarStore((s) => s.end)
   const { params: fp } = useSupportedFilterParams()
@@ -29,7 +31,7 @@ export function useAgentTurns({ page, pageSize, sortBy, sortOrder, status, agent
     queryKey: ["agent-turns", {
       start, end, page, pageSize, sortBy, sortOrder,
       ...fp,
-      status, agentKind, clientIp, includeProxyHops,
+      status, agentKind, clientIp, serverPort, includeProxyHops,
     }],
     queryFn: () =>
       apiFetch<AgentTurnsPage>("/api/agent-turns", {
@@ -43,6 +45,7 @@ export function useAgentTurns({ page, pageSize, sortBy, sortOrder, status, agent
         status: status || undefined,
         agent_kind: agentKind || undefined,
         client_ip: clientIp || undefined,
+        server_port: serverPort || undefined,
         include_proxy_hops: includeProxyHops ? "true" : undefined,
       }),
     placeholderData: (prev) => prev,
diff --git a/console/src/hooks/use-llm-calls.ts b/console/src/hooks/use-llm-calls.ts
index bcd5d955..e2c904e8 100644
--- a/console/src/hooks/use-llm-calls.ts
+++ b/console/src/hooks/use-llm-calls.ts
@@ -13,6 +13,8 @@ interface UseLlmCallsParams {
   statusCode?: string
   finishReason?: string
   clientIp?: string
+  /** CSV of u16 server ports e.g. "4210,9000" */
+  serverPort?: string
   requestPath?: string
   /** Stream-mode filter: "stream", "non-stream", or undefined for all. */
   isStream?: string
@@ -26,6 +28,7 @@ export function useLlmCalls({
   statusCode,
   finishReason,
   clientIp,
+  serverPort,
   requestPath,
   isStream,
 }: UseLlmCallsParams) {
@@ -37,7 +40,7 @@ export function useLlmCalls({
     queryKey: ["llm-calls", {
       start, end, page, pageSize, sortBy, sortOrder,
       ...fp,
-      statusCode, finishReason, clientIp, requestPath, isStream,
+      statusCode, finishReason, clientIp, serverPort, requestPath, isStream,
     }],
     queryFn: () =>
       apiFetch<LlmCallsPage>("/api/llm-calls", {
@@ -51,6 +54,7 @@ export function useLlmCalls({
         status_code: statusCode || undefined,
         finish_reason: finishReason || undefined,
         client_ip: clientIp || undefined,
+        server_port: serverPort || undefined,
         request_path: requestPath || undefined,
         is_stream: isStream || undefined,
       }),
diff --git a/console/src/hooks/use-services-topology.ts b/console/src/hooks/use-services-topology.ts
new file mode 100644
index 00000000..f864da62
--- /dev/null
+++ b/console/src/hooks/use-services-topology.ts
@@ -0,0 +1,16 @@
+import { useQuery } from "@tanstack/react-query"
+import { apiFetch } from "@/lib/api"
+import { useToolbarStore } from "@/stores/toolbar"
+import type { ServicesTopology } from "@/types/api"
+
+export function useServicesTopology() {
+  const start = useToolbarStore((s) => s.start)
+  const end = useToolbarStore((s) => s.end)
+
+  return useQuery({
+    queryKey: ["services-topology", { start, end }],
+    queryFn: () =>
+      apiFetch<ServicesTopology>("/api/services/topology", { start, end }),
+    placeholderData: (prev) => prev,
+  })
+}
diff --git a/console/src/hooks/use-services.ts b/console/src/hooks/use-services.ts
new file mode 100644
index 00000000..bed31c3c
--- /dev/null
+++ b/console/src/hooks/use-services.ts
@@ -0,0 +1,28 @@
+import { useQuery } from "@tanstack/react-query"
+import { apiFetch } from "@/lib/api"
+import { useToolbarStore } from "@/stores/toolbar"
+import type { ServicesData } from "@/types/api"
+
+interface UseServicesParams {
+  sortBy?: string
+  sortOrder?: "asc" | "desc"
+  limit?: number
+}
+
+export function useServices({ sortBy = "call_count", sortOrder = "desc", limit = 200 }: UseServicesParams = {}) {
+  const start = useToolbarStore((s) => s.start)
+  const end = useToolbarStore((s) => s.end)
+
+  return useQuery({
+    queryKey: ["services", { start, end, sortBy, sortOrder, limit }],
+    queryFn: () =>
+      apiFetch<ServicesData>("/api/services", {
+        start,
+        end,
+        sort_by: sortBy,
+        sort_order: sortOrder,
+        limit,
+      }),
+    placeholderData: (prev) => prev,
+  })
+}
diff --git a/console/src/pages/agent-turns.tsx b/console/src/pages/agent-turns.tsx
index 24e4692d..7c07175e 100644
--- a/console/src/pages/agent-turns.tsx
+++ b/console/src/pages/agent-turns.tsx
@@ -98,6 +98,7 @@ export function AgentTurnsPage() {
   const [statusStr, setStatusStr] = useSearchParamState("status", "")
   const [agentKindStr, setAgentKindStr] = useSearchParamState("agent_kind", "")
   const [clientIpStr, setClientIpStr] = useSearchParamState("client_ip", "")
+  const [serverPortStr, setServerPortStr] = useSearchParamState("server_port", "")
   // Default off — the user wanted the folded view as the primary
   // experience. URL serialization keeps "show hops" sticky on a
   // shared link.
@@ -139,6 +140,7 @@ export function AgentTurnsPage() {
     status: statusStr || undefined,
     agentKind: agentKindStr || undefined,
     clientIp: clientIpStr || undefined,
+    serverPort: serverPortStr || undefined,
     includeProxyHops,
   })
 
@@ -192,6 +194,13 @@ export function AgentTurnsPage() {
           placeholder="Client IP (CSV)"
           className="w-[180px] rounded-lg border border-border bg-background px-2.5 py-1.5 text-xs placeholder:text-muted-foreground focus:border-foreground/20 focus:outline-none"
         />
+        <input
+          value={serverPortStr}
+          onChange={(e) => { setServerPortStr(e.target.value); setPageStr("1") }}
+          placeholder="Server Port (CSV)"
+          inputMode="numeric"
+          className="w-[140px] rounded-lg border border-border bg-background px-2.5 py-1.5 text-xs placeholder:text-muted-foreground focus:border-foreground/20 focus:outline-none"
+        />
         <label
           className="inline-flex cursor-pointer select-none items-center gap-1.5 rounded-lg border border-border px-2.5 py-1.5 text-xs hover:bg-muted"
           title="Show the upstream/mirror leg of llmproxy duplicates (hidden by default)"
diff --git a/console/src/pages/llm-calls.tsx b/console/src/pages/llm-calls.tsx
index 2150b228..1584070d 100644
--- a/console/src/pages/llm-calls.tsx
+++ b/console/src/pages/llm-calls.tsx
@@ -137,6 +137,7 @@ export function LlmCallsPage() {
   const [statusStr, setStatusStr] = useSearchParamState("status", "")
   const [finishStr, setFinishStr] = useSearchParamState("finish", "")
   const [clientIpStr, setClientIpStr] = useSearchParamState("client_ip", "")
+  const [serverPortStr, setServerPortStr] = useSearchParamState("server_port", "")
   const [pathStr, setPathStr] = useSearchParamState("path", "")
   const [streamStr, setStreamStr] = useSearchParamState("is_stream", "")
 
@@ -184,6 +185,7 @@ export function LlmCallsPage() {
     statusCode: statusQuery,
     finishReason: finishQuery,
     clientIp: clientIpStr || undefined,
+    serverPort: serverPortStr || undefined,
     requestPath: pathStr || undefined,
     isStream: streamFilter || undefined,
   })
@@ -271,6 +273,13 @@ export function LlmCallsPage() {
           placeholder="Client IP (CSV)"
           className="w-[180px] rounded-lg border border-border bg-background px-2.5 py-1.5 text-xs placeholder:text-muted-foreground focus:border-foreground/20 focus:outline-none"
         />
+        <input
+          value={serverPortStr}
+          onChange={(e) => { setServerPortStr(e.target.value); setPageStr("1") }}
+          placeholder="Server Port (CSV)"
+          inputMode="numeric"
+          className="w-[140px] rounded-lg border border-border bg-background px-2.5 py-1.5 text-xs placeholder:text-muted-foreground focus:border-foreground/20 focus:outline-none"
+        />
         <input
           value={pathStr}
           onChange={(e) => { setPathStr(e.target.value); setPageStr("1") }}
diff --git a/console/src/pages/overview.tsx b/console/src/pages/overview.tsx
index a13fe96e..ab64d608 100644
--- a/console/src/pages/overview.tsx
+++ b/console/src/pages/overview.tsx
@@ -2,12 +2,15 @@ import { Loader2 } from "lucide-react"
 import { cn } from "@/lib/utils"
 import { formatMs, formatNumber } from "@/lib/format"
 import { useMetricsSummary, useTimeseries, useModels } from "@/hooks/use-metrics"
+import { useAgentActivity, useAgentSummary } from "@/hooks/use-agent-overview"
 import { useInternalMetricsSeries } from "@/hooks/use-internal-metrics"
 import { useToolbarStore } from "@/stores/toolbar"
 import { RequestVolumeChart } from "@/components/charts/request-volume-chart"
 import { LatencyOverviewChart } from "@/components/charts/latency-overview-chart"
 import { ModelBreakdownChart } from "@/components/charts/model-breakdown-chart"
 import { ErrorByModelChart } from "@/components/charts/error-by-model-chart"
+import { AgentActivityChart } from "@/components/charts/agent-activity-chart"
+import { AgentDistributionChart } from "@/components/charts/agent-distribution-chart"
 import { ActiveGaugeChart } from "@/components/charts/active-gauge-chart"
 
 function KpiCard({
@@ -50,6 +53,8 @@ export function OverviewPage() {
   const { data: volumeTs } = useTimeseries("call_count", { groupBy: "wire_api" })
   const { data: latencyTs } = useTimeseries("ttft_avg,ttft_p95,e2e_avg,e2e_p95")
   const { data: modelsData } = useModels()
+  const { data: agentActivity } = useAgentActivity()
+  const { data: agentSummary } = useAgentSummary()
   // Toolbar exposes `start` as unix-seconds; convert to ms for the series API.
   const start = useToolbarStore((s) => s.start)
   const { data: gauges } = useInternalMetricsSeries({
@@ -121,6 +126,18 @@ export function OverviewPage() {
         </div>
       </div>
 
+      {/* Agent row — activity timeseries + distribution */}
+      <div className="grid grid-cols-2 gap-4">
+        <div className="rounded-lg border border-border bg-card p-4">
+          <h3 className="mb-3 text-sm font-medium">Agent Activity</h3>
+          <AgentActivityChart points={agentActivity?.points ?? []} />
+        </div>
+        <div className="rounded-lg border border-border bg-card p-4">
+          <h3 className="mb-3 text-sm font-medium">Agent Distribution</h3>
+          <AgentDistributionChart rows={agentSummary?.summary ?? []} />
+        </div>
+      </div>
+
       {/* Active concurrency — live gauges from internal_metrics ring */}
       <div className="grid grid-cols-2 gap-4">
         <div className="rounded-lg border border-border bg-card p-4">
diff --git a/console/src/pages/services.tsx b/console/src/pages/services.tsx
new file mode 100644
index 00000000..e6e8ea71
--- /dev/null
+++ b/console/src/pages/services.tsx
@@ -0,0 +1,381 @@
+import { useMemo, useState } from "react"
+import { ArrowUpDown, Loader2, Table as TableIcon, Network, Cpu } from "lucide-react"
+import { cn } from "@/lib/utils"
+import { formatMs, formatNumber } from "@/lib/format"
+import { useServices } from "@/hooks/use-services"
+import { useServicesTopology } from "@/hooks/use-services-topology"
+import { ServicePathView } from "@/components/services/path-view"
+import { ModelsPage } from "@/pages/models"
+import type { ServiceRow } from "@/types/api"
+
+type ViewMode = "table" | "path" | "model"
+
+type SortKey =
+  | "endpoint"
+  | "call_count"
+  | "error_rate"
+  | "ttft_avg_ms"
+  | "ttft_p95_ms"
+  | "e2e_avg_ms"
+  | "e2e_p95_ms"
+  | "total_input_tokens"
+  | "total_output_tokens"
+  | "last_seen_ms"
+type SortOrder = "asc" | "desc"
+
+function errorRate(s: ServiceRow): number {
+  return s.call_count > 0 ? (s.error_count / s.call_count) * 100 : 0
+}
+
+function getSortValue(s: ServiceRow, key: SortKey): number | string {
+  if (key === "endpoint") return `${s.server_ip}:${s.server_port}`
+  if (key === "error_rate") return errorRate(s)
+  return (s[key as keyof ServiceRow] as number) ?? 0
+}
+
+/// Color theme per app — picked so the most common production
+/// surfaces (vllm/litellm) read at a glance. Falls back to muted gray
+/// for unknown so the absence of detection is visually quiet.
+const APP_BADGE_STYLE: Record<string, string> = {
+  vllm: "bg-purple-100 text-purple-800 dark:bg-purple-900/40 dark:text-purple-300",
+  sglang: "bg-cyan-100 text-cyan-800 dark:bg-cyan-900/40 dark:text-cyan-300",
+  ollama: "bg-amber-100 text-amber-800 dark:bg-amber-900/40 dark:text-amber-300",
+  llamacpp: "bg-emerald-100 text-emerald-800 dark:bg-emerald-900/40 dark:text-emerald-300",
+  litellm: "bg-pink-100 text-pink-800 dark:bg-pink-900/40 dark:text-pink-300",
+  openai: "bg-green-100 text-green-800 dark:bg-green-900/40 dark:text-green-300",
+  anthropic: "bg-orange-100 text-orange-800 dark:bg-orange-900/40 dark:text-orange-300",
+  gemini: "bg-blue-100 text-blue-800 dark:bg-blue-900/40 dark:text-blue-300",
+}
+
+function AppBadge({ app, serverHeader }: { app: string | null; serverHeader: string | null }) {
+  if (!app) {
+    return (
+      <span
+        className="rounded bg-muted/50 px-1.5 py-0.5 text-[10px] text-muted-foreground"
+        title={serverHeader ? `Server: ${serverHeader}` : "No identifying signal"}
+      >
+        unknown
+      </span>
+    )
+  }
+  const cls =
+    APP_BADGE_STYLE[app] ??
+    "bg-slate-200 text-slate-800 dark:bg-slate-700/60 dark:text-slate-200"
+  const title = serverHeader
+    ? `Server: ${serverHeader}`
+    : `Identified as ${app} (no Server header sample)`
+  return (
+    <span
+      className={cn("rounded px-1.5 py-0.5 text-[10px] font-medium", cls)}
+      title={title}
+    >
+      {app}
+    </span>
+  )
+}
+
+function formatAgo(ms: number): string {
+  const diff = Date.now() - ms
+  if (diff < 0) return "just now"
+  const s = Math.floor(diff / 1000)
+  if (s < 60) return `${s}s ago`
+  const m = Math.floor(s / 60)
+  if (m < 60) return `${m}m ago`
+  const h = Math.floor(m / 60)
+  if (h < 48) return `${h}h ago`
+  const d = Math.floor(h / 24)
+  return `${d}d ago`
+}
+
+export function ServicesPage() {
+  const [view, setView] = useState<ViewMode>("table")
+  const [sortKey, setSortKey] = useState<SortKey>("call_count")
+  const [sortOrder, setSortOrder] = useState<SortOrder>("desc")
+  const { data, isLoading } = useServices({
+    sortBy:
+      // Sort interactively in JS — the server-side sort_by accepts
+      // matching column names but we keep client-side sorting for
+      // responsive header clicks without refetching.
+      "call_count",
+    sortOrder: "desc",
+  })
+
+  const services = useMemo(() => data?.services ?? [], [data])
+
+  const sorted = useMemo(() => {
+    const arr = [...services]
+    arr.sort((a, b) => {
+      const av = getSortValue(a, sortKey)
+      const bv = getSortValue(b, sortKey)
+      if (typeof av === "string" && typeof bv === "string") {
+        return sortOrder === "asc" ? av.localeCompare(bv) : bv.localeCompare(av)
+      }
+      return sortOrder === "asc"
+        ? (av as number) - (bv as number)
+        : (bv as number) - (av as number)
+    })
+    return arr
+  }, [services, sortKey, sortOrder])
+
+  function handleSort(key: SortKey) {
+    if (key === sortKey) {
+      setSortOrder(sortOrder === "asc" ? "desc" : "asc")
+    } else {
+      setSortKey(key)
+      setSortOrder("desc")
+    }
+  }
+
+  function SortHeader({
+    label,
+    field,
+    align,
+  }: {
+    label: string
+    field: SortKey
+    align?: "left" | "right"
+  }) {
+    const active = sortKey === field
+    return (
+      <button
+        className={cn(
+          "inline-flex items-center gap-1 text-xs font-medium text-muted-foreground hover:text-foreground",
+          align === "right" && "justify-end",
+        )}
+        onClick={() => handleSort(field)}
+      >
+        {label}
+        <ArrowUpDown
+          className={`size-3 ${active ? "text-foreground" : "opacity-40"}`}
+        />
+      </button>
+    )
+  }
+
+  return (
+    <div className="flex flex-col gap-4 p-4">
+      <ViewTabs view={view} onChange={setView} />
+      {view === "path" ? (
+        <PathViewContainer />
+      ) : view === "model" ? (
+        <ModelsPage />
+      ) : (
+      <div className="rounded-lg border border-border bg-card">
+        <div className="overflow-auto">
+          <table className="w-full text-sm">
+            <thead>
+              <tr className="border-b border-border">
+                <th className="px-4 py-3 text-left">
+                  <SortHeader label="Endpoint" field="endpoint" align="left" />
+                </th>
+                <th className="px-3 py-3 text-left text-xs font-medium text-muted-foreground">
+                  App
+                </th>
+                <th className="px-3 py-3 text-left text-xs font-medium text-muted-foreground">
+                  Models
+                </th>
+                <th className="px-3 py-3 text-left text-xs font-medium text-muted-foreground">
+                  Wire API
+                </th>
+                <th className="px-3 py-3 text-right">
+                  <SortHeader label="Calls" field="call_count" align="right" />
+                </th>
+                <th className="px-3 py-3 text-right">
+                  <SortHeader label="Error %" field="error_rate" align="right" />
+                </th>
+                <th className="px-3 py-3 text-right">
+                  <SortHeader label="TTFT avg" field="ttft_avg_ms" align="right" />
+                </th>
+                <th className="px-3 py-3 text-right">
+                  <SortHeader label="TTFT p95" field="ttft_p95_ms" align="right" />
+                </th>
+                <th className="px-3 py-3 text-right">
+                  <SortHeader label="E2E avg" field="e2e_avg_ms" align="right" />
+                </th>
+                <th className="px-3 py-3 text-right">
+                  <SortHeader label="E2E p95" field="e2e_p95_ms" align="right" />
+                </th>
+                <th className="px-3 py-3 text-right">
+                  <SortHeader label="In Tokens" field="total_input_tokens" align="right" />
+                </th>
+                <th className="px-3 py-3 text-right">
+                  <SortHeader label="Out Tokens" field="total_output_tokens" align="right" />
+                </th>
+                <th className="px-3 py-3 text-right">
+                  <SortHeader label="Last seen" field="last_seen_ms" align="right" />
+                </th>
+              </tr>
+            </thead>
+            <tbody>
+              {isLoading && services.length === 0 ? (
+                <tr>
+                  <td colSpan={13} className="py-12 text-center text-muted-foreground">
+                    Loading…
+                  </td>
+                </tr>
+              ) : sorted.length === 0 ? (
+                <tr>
+                  <td colSpan={13} className="py-12 text-center text-muted-foreground">
+                    No services found in selected time range
+                  </td>
+                </tr>
+              ) : (
+                sorted.map((s) => {
+                  const err = errorRate(s)
+                  const key = `${s.server_ip}:${s.server_port}`
+                  return (
+                    <tr key={key} className="border-b border-border/30 hover:bg-muted/30">
+                      <td className="px-4 py-2.5 font-mono text-xs">
+                        <span className="font-medium">{s.server_ip}</span>
+                        <span className="text-muted-foreground">:{s.server_port}</span>
+                      </td>
+                      <td className="px-3 py-2.5">
+                        <AppBadge app={s.app} serverHeader={s.server_header} />
+                      </td>
+                      <td className="px-3 py-2.5">
+                        <div className="flex flex-wrap gap-1">
+                          {s.models.slice(0, 4).map((m) => (
+                            <span
+                              key={m}
+                              className="rounded bg-muted px-1.5 py-0.5 font-mono text-[10px] text-foreground"
+                              title={m}
+                            >
+                              {m.length > 24 ? `${m.slice(0, 22)}…` : m}
+                            </span>
+                          ))}
+                          {s.models.length > 4 && (
+                            <span
+                              className="rounded border border-dashed border-border px-1.5 py-0.5 text-[10px] text-muted-foreground"
+                              title={s.models.slice(4).join(", ")}
+                            >
+                              +{s.models.length - 4} more
+                            </span>
+                          )}
+                        </div>
+                      </td>
+                      <td className="px-3 py-2.5 text-xs text-muted-foreground">
+                        {s.wire_apis.join(", ")}
+                      </td>
+                      <td className="px-3 py-2.5 text-right tabular-nums">
+                        {formatNumber(s.call_count)}
+                        {s.stream_count > 0 && (
+                          <span
+                            className="ml-1 text-[10px] text-muted-foreground"
+                            title={`${formatNumber(s.stream_count)} streaming calls`}
+                          >
+                            ({Math.round((s.stream_count / s.call_count) * 100)}% str)
+                          </span>
+                        )}
+                      </td>
+                      <td className="px-3 py-2.5 text-right tabular-nums">
+                        <span
+                          className={
+                            err > 5 ? "text-red-500" : err > 1 ? "text-amber-500" : ""
+                          }
+                        >
+                          {err.toFixed(1)}%
+                        </span>
+                      </td>
+                      <td className="px-3 py-2.5 text-right tabular-nums">
+                        {formatMs(s.ttft_avg_ms)}
+                      </td>
+                      <td className="px-3 py-2.5 text-right tabular-nums">
+                        {formatMs(s.ttft_p95_ms)}
+                      </td>
+                      <td className="px-3 py-2.5 text-right tabular-nums">
+                        {formatMs(s.e2e_avg_ms)}
+                      </td>
+                      <td className="px-3 py-2.5 text-right tabular-nums">
+                        {formatMs(s.e2e_p95_ms)}
+                      </td>
+                      <td className="px-3 py-2.5 text-right tabular-nums text-muted-foreground">
+                        {formatNumber(s.total_input_tokens)}
+                      </td>
+                      <td className="px-3 py-2.5 text-right tabular-nums text-muted-foreground">
+                        {formatNumber(s.total_output_tokens)}
+                      </td>
+                      <td
+                        className="px-3 py-2.5 text-right text-xs text-muted-foreground tabular-nums"
+                        title={new Date(s.last_seen_ms).toLocaleString()}
+                      >
+                        {formatAgo(s.last_seen_ms)}
+                      </td>
+                    </tr>
+                  )
+                })
+              )}
+            </tbody>
+          </table>
+        </div>
+      </div>
+      )}
+    </div>
+  )
+}
+
+function ViewTabs({ view, onChange }: { view: ViewMode; onChange: (v: ViewMode) => void }) {
+  return (
+    <div className="inline-flex w-fit rounded-lg border border-border bg-card p-0.5">
+      <button
+        onClick={() => onChange("table")}
+        className={cn(
+          "inline-flex items-center gap-1.5 rounded-md px-3 py-1.5 text-xs font-medium",
+          view === "table"
+            ? "bg-muted text-foreground"
+            : "text-muted-foreground hover:text-foreground",
+        )}
+      >
+        <TableIcon className="size-3.5" />
+        Table
+      </button>
+      <button
+        onClick={() => onChange("path")}
+        className={cn(
+          "inline-flex items-center gap-1.5 rounded-md px-3 py-1.5 text-xs font-medium",
+          view === "path"
+            ? "bg-muted text-foreground"
+            : "text-muted-foreground hover:text-foreground",
+        )}
+      >
+        <Network className="size-3.5" />
+        Path
+      </button>
+      <button
+        onClick={() => onChange("model")}
+        className={cn(
+          "inline-flex items-center gap-1.5 rounded-md px-3 py-1.5 text-xs font-medium",
+          view === "model"
+            ? "bg-muted text-foreground"
+            : "text-muted-foreground hover:text-foreground",
+        )}
+      >
+        <Cpu className="size-3.5" />
+        Model
+      </button>
+    </div>
+  )
+}
+
+function PathViewContainer() {
+  const { data, isLoading } = useServicesTopology()
+  if (isLoading && !data) {
+    return (
+      <div className="flex h-[400px] items-center justify-center text-sm text-muted-foreground">
+        <Loader2 className="mr-2 size-4 animate-spin" />
+        Building topology…
+      </div>
+    )
+  }
+  if (!data) {
+    return (
+      <div className="flex h-[400px] items-center justify-center text-sm text-muted-foreground">
+        No topology data
+      </div>
+    )
+  }
+  return (
+    <div className="rounded-lg border border-border bg-card p-3">
+      <ServicePathView topology={data} />
+    </div>
+  )
+}
diff --git a/console/src/types/api.ts b/console/src/types/api.ts
index 2fda1711..1e93ffff 100644
--- a/console/src/types/api.ts
+++ b/console/src/types/api.ts
@@ -63,6 +63,99 @@ export interface ModelsData {
   models: MetricsModelRow[]
 }
 
+export interface ServicesData {
+  services: ServiceRow[]
+}
+
+export interface ServiceRow {
+  server_ip: string
+  server_port: number
+  models: string[]
+  wire_apis: string[]
+  request_paths: string[]
+  call_count: number
+  error_count: number
+  stream_count: number
+  total_input_tokens: number
+  total_output_tokens: number
+  ttft_avg_ms: number | null
+  ttft_p95_ms: number | null
+  e2e_avg_ms: number | null
+  e2e_p95_ms: number | null
+  first_seen_ms: number
+  last_seen_ms: number
+  /** Server software label — "vllm" / "sglang" / "ollama" /
+   * "llamacpp" / "litellm" / "openai-compat" / "openai" / "anthropic"
+   * / "gemini" / null (unknown). vLLM and SGLang both run on uvicorn
+   * so they're currently bucketed as "openai-compat". */
+  app: string | null
+  /** Raw `Server` HTTP response header value, for the badge tooltip. */
+  server_header: string | null
+}
+
+/** One node in the service-topology graph powering the Path view.
+ * The synthetic clients aggregate uses `server_ip = "__clients__"` and
+ * `server_port = 0` — the UI should treat those as a single
+ * left-anchored super-node, not as a real endpoint. */
+export interface TopologyNode {
+  server_ip: string
+  server_port: number
+  app: string | null
+  models: string[]
+  call_count: number
+}
+
+/** One directed edge.
+ *  - `kind: "proxy"` — pair-sweeper-confirmed hop, real service →
+ *    real service.
+ *  - `kind: "inferred"` — heuristic edge: caller_ip matches a known
+ *    service's server_ip (typically LiteLLM forwarding to a real
+ *    backend) but pair_sweeper hasn't paired the turn. Drawn as
+ *    a dashed blue line so users can tell it apart from confirmed
+ *    proxy hops.
+ *  - `kind: "client"` — synthetic edge from `__clients__` into an
+ *    entry-point service whose caller_ip doesn't resolve to any
+ *    known service. */
+export interface TopologyEdge {
+  from_ip: string
+  from_port: number
+  to_ip: string
+  to_port: number
+  turn_count: number
+  kind: "proxy" | "inferred" | "client"
+}
+
+export interface ServicesTopology {
+  nodes: TopologyNode[]
+  edges: TopologyEdge[]
+}
+
+/** One aggregate row per agent_kind over a time window. */
+export interface AgentKindSummary {
+  agent_kind: string
+  turn_count: number
+  total_input_tokens: number
+  total_output_tokens: number
+  avg_duration_ms: number | null
+  last_seen_ms: number
+}
+
+export interface AgentSummaryData {
+  summary: AgentKindSummary[]
+}
+
+/** One bucket-row of `(timestamp, agent_kind, count)` for the
+ *  Overview activity chart. */
+export interface AgentActivityPoint {
+  timestamp_ms: number
+  agent_kind: string
+  turn_count: number
+}
+
+export interface AgentActivityData {
+  points: AgentActivityPoint[]
+}
+
 export interface MetricsModelRow {
   wire_api: string
   model: string
diff --git a/server/ts-api/src/lib.rs b/server/ts-api/src/lib.rs
index 07e62585..f40d08bc 100644
--- a/server/ts-api/src/lib.rs
+++ b/server/ts-api/src/lib.rs
@@ -148,6 +148,14 @@ pub fn router(
     };
     let agent_turns_routes = Router::new()
         .route("/api/agent-turns", get(routes::agent_turns::list))
+        .route(
+            "/api/agent-turns/summary",
+            get(routes::agent_turns::summary),
+        )
+        .route(
+            "/api/agent-turns/activity",
+            get(routes::agent_turns::activity),
+        )
         .route("/api/agent-turns/{id}", get(routes::agent_turns::detail))
         .route(
             "/api/agent-turns/{id}/calls",
@@ -179,6 +187,11 @@ pub fn router(
         .route("/api/metrics/timeseries", get(routes::metrics::timeseries))
         .route("/api/metrics/summary", get(routes::metrics::summary))
         .route("/api/metrics/models", get(routes::metrics::models))
+        .route("/api/services", get(routes::services::services))
+        .route(
+            "/api/services/topology",
+            get(routes::services::services_topology),
+        )
         .route(
             "/api/metrics/finish-reasons",
             get(routes::metrics::finish_reasons),
diff --git a/server/ts-api/src/routes/agent_turns.rs b/server/ts-api/src/routes/agent_turns.rs
index 09c9266d..17bbe8b3 100644
--- a/server/ts-api/src/routes/agent_turns.rs
+++ b/server/ts-api/src/routes/agent_turns.rs
@@ -4,8 +4,9 @@ use axum::extract::State;
 use axum::response::IntoResponse;
 use serde::Deserialize;
 use ts_storage::query::{
-    CallDetail, HeaderDiffEntry, HeaderDiffKind, HeaderValueByLeg, LatencyBreakdown,
-    ModelRewrite, ProxyViewMember, ProxyViewResponse, TurnDetail, TurnListItem, TurnsQuery,
+    AgentActivityPoint, AgentActivityQuery, AgentKindSummary, AgentSummaryQuery, CallDetail,
+    HeaderDiffEntry, HeaderDiffKind, HeaderValueByLeg, LatencyBreakdown, ModelRewrite,
+    ProxyViewMember, ProxyViewResponse, TurnDetail, TurnListItem, TurnsQuery,
 };
 use ts_turn::AgentTurn;
 
@@ -26,6 +27,10 @@ pub struct TurnsParams {
     pub server_ip: Option<String>,
     #[serde(default)]
     pub client_ip: Option<String>,
+    /// CSV of u16 server ports. Resolved through the turn's first
+    /// call_id against `llm_calls.server_port`.
+    #[serde(default)]
+    pub server_port: Option<String>,
     #[serde(default)]
     pub status: Option<String>,
     #[serde(default)]
@@ -64,10 +69,19 @@ pub async fn list(
 ) -> Result<impl IntoResponse, ApiError> {
     let page_size = params.page_size.min(200);
 
+    let server_ports: Vec<u16> = parse_csv(&params.server_port)
+        .iter()
+        .map(|s| {
+            s.parse::<u16>()
+                .map_err(|_| ApiError::InvalidParam(format!("invalid server_port: {s}")))
+        })
+        .collect::<Result<Vec<_>, _>>()?;
+
     let query = TurnsQuery {
         time_range: to_time_range(params.start, params.end),
         filter: to_dimension_filter(&params.wire_api, &params.model, &params.server_ip),
         client_ips: parse_csv(&params.client_ip),
+        server_ports,
         statuses: parse_csv(&params.status),
         agent_kinds: parse_csv(&params.agent_kind),
         sort_by: params.sort_by,
@@ -568,6 +582,54 @@ fn compute_latency_breakdown(members: &[ProxyViewMember]) -> LatencyBreakdown {
     }
 }
 
+#[derive(Debug, Deserialize)]
+pub struct AgentSummaryParams {
+    pub start: i64,
+    pub end: i64,
+}
+
+#[derive(serde::Serialize)]
+struct AgentSummaryResp {
+    summary: Vec<AgentKindSummary>,
+}
+
+pub async fn summary(
+    State(ctx): State<ApiAgentTurnsContext>,
+    Query(params): Query<AgentSummaryParams>,
+) -> Result<impl IntoResponse, ApiError> {
+    let query = AgentSummaryQuery {
+        time_range: to_time_range(params.start, params.end),
+    };
+    let summary = ctx.storage.query_agent_summary(&query).await?;
+    Ok(ApiResponse::ok(AgentSummaryResp { summary }))
+}
+
+#[derive(Debug, Deserialize)]
+pub struct AgentActivityParams {
+    pub start: i64,
+    pub end: i64,
+    #[serde(default)]
+    pub bucket: Option<u32>,
+}
+
+#[derive(serde::Serialize)]
+struct AgentActivityResp {
+    points: Vec<AgentActivityPoint>,
+}
+
+pub async fn activity(
+    State(ctx): State<ApiAgentTurnsContext>,
+    Query(params): Query<AgentActivityParams>,
+) -> Result<impl IntoResponse, ApiError> {
+    let query = AgentActivityQuery {
+        time_range: to_time_range(params.start, params.end),
+        bucket_seconds: params.bucket,
+    };
+    let points = ctx.storage.query_agent_activity(&query).await?;
+    Ok(ApiResponse::ok(AgentActivityResp { points }))
+}
+
+
 #[cfg(test)]
 mod proxy_view_tests {
     use super::*;
diff --git a/server/ts-api/src/routes/llm_calls.rs b/server/ts-api/src/routes/llm_calls.rs
index f3275b51..ac1d3144 100644
--- a/server/ts-api/src/routes/llm_calls.rs
+++ b/server/ts-api/src/routes/llm_calls.rs
@@ -26,6 +26,9 @@ pub struct CallsParams {
     pub finish_reason: Option<String>,
     #[serde(default)]
     pub client_ip: Option<String>,
+    /// CSV of u16 server ports. Filters `llm_calls.server_port` directly.
+    #[serde(default)]
+    pub server_port: Option<String>,
     /// Substring match against `request_path` (case-sensitive, `LIKE '%…%'`).
     #[serde(default)]
     pub request_path: Option<String>,
@@ -69,6 +72,14 @@ pub async fn list(
         })
         .collect::<Result<Vec<_>, _>>()?;
 
+    let server_ports: Vec<u16> = parse_csv(&params.server_port)
+        .iter()
+        .map(|s| {
+            s.parse::<u16>()
+                .map_err(|_| ApiError::InvalidParam(format!("invalid server_port: {s}")))
+        })
+        .collect::<Result<Vec<_>, _>>()?;
+
     let is_stream = match params.is_stream.as_deref() {
         None | Some("") | Some("all") => None,
         Some("stream") | Some("true") | Some("1") => Some(true),
@@ -86,6 +97,7 @@ pub async fn list(
         status_codes,
         finish_reasons: parse_csv(&params.finish_reason),
         client_ips: parse_csv(&params.client_ip),
+        server_ports,
         request_path_contains: params.request_path.filter(|s| !s.is_empty()),
         is_stream,
         sort_by: params.sort_by,
diff --git a/server/ts-api/src/routes/mod.rs b/server/ts-api/src/routes/mod.rs
index 26aefa7e..040b17fe 100644
--- a/server/ts-api/src/routes/mod.rs
+++ b/server/ts-api/src/routes/mod.rs
@@ -10,3 +10,4 @@ pub mod llm_calls;
 pub mod metrics;
 pub mod pcap_extract;
 pub mod runtime_config;
+pub mod services;
diff --git a/server/ts-api/src/routes/services.rs b/server/ts-api/src/routes/services.rs
new file mode 100644
index 00000000..c15a6811
--- /dev/null
+++ b/server/ts-api/src/routes/services.rs
@@ -0,0 +1,86 @@
+//! `GET /api/services` — Services view.
+//!
+//! One row per unique `(server_ip, server_port)` endpoint with the
+//! models that endpoint served, error counts, throughput, and TTFT /
+//! E2E percentiles in the requested window. Powers the Console's
+//! Services page.
+//!
+//! Backed by `llm_calls` (NOT the pre-aggregated `llm_metrics` table
+//! — that schema's grouping sets stop at `server_ip`, which would
+//! conflate multiple LLM servers on the same host).
+
+use axum::extract::State;
+use axum::response::IntoResponse;
+use serde::{Deserialize, Serialize};
+use std::sync::Arc;
+use ts_storage::query::{ServicesQuery, ServicesTopologyQuery};
+use ts_storage::StorageBackend;
+
+use crate::extractors::Query;
+use crate::params::to_time_range;
+use crate::response::{ApiError, ApiResponse};
+
+#[derive(Debug, Deserialize)]
+pub struct ServicesParams {
+    /// Inclusive start in seconds since epoch.
+    pub start: i64,
+    /// Exclusive end in seconds since epoch.
+    pub end: i64,
+    #[serde(default = "default_services_sort_by")]
+    pub sort_by: String,
+    #[serde(default = "default_sort_order")]
+    pub sort_order: String,
+    #[serde(default = "default_services_limit")]
+    pub limit: u32,
+}
+
+fn default_services_sort_by() -> String {
+    "call_count".to_string()
+}
+
+fn default_sort_order() -> String {
+    "desc".to_string()
+}
+
+fn default_services_limit() -> u32 {
+    // Soft cap — even a busy install rarely has more than a couple
+    // dozen distinct LLM serving endpoints. 200 is a sanity ceiling
+    // so a misconfigured deployment can't return a giant payload.
+    200
+}
+
+#[derive(Serialize)]
+struct ServicesData {
+    services: Vec<ts_storage::query::ServiceRow>,
+}
+
+pub async fn services(
+    State(storage): State<Arc<dyn StorageBackend>>,
+    Query(params): Query<ServicesParams>,
+) -> Result<impl IntoResponse, ApiError> {
+    let query = ServicesQuery {
+        time_range: to_time_range(params.start, params.end),
+        sort_by: params.sort_by,
+        sort_order: params.sort_order,
+        limit: params.limit.min(500),
+    };
+    let rows = storage.query_services(&query).await?;
+    Ok(ApiResponse::ok(ServicesData { services: rows }))
+}
+
+#[derive(Debug, Deserialize)]
+pub struct ServicesTopologyParams {
+    pub start: i64,
+    pub end: i64,
+}
+
+pub async fn services_topology(
+    State(storage): State<Arc<dyn StorageBackend>>,
+    Query(params): Query<ServicesTopologyParams>,
+) -> Result<impl IntoResponse, ApiError> {
+    let query = ServicesTopologyQuery {
+        time_range: to_time_range(params.start, params.end),
+    };
+    let topology = storage.query_services_topology(&query).await?;
+    Ok(ApiResponse::ok(topology))
+}
diff --git a/server/ts-storage-duckdb/src/apps.rs b/server/ts-storage-duckdb/src/apps.rs
new file mode 100644
index 00000000..0bed7dc3
--- /dev/null
+++ b/server/ts-storage-duckdb/src/apps.rs
@@ -0,0 +1,555 @@
+//! Best-effort serving-software classification for the Services view.
+//!
+//! Wire-traffic doesn't carry an "I am vLLM" header. Each project
+//! leaves slightly different fingerprints though, and combining a
+//! handful of cheap signals — `Server` response header, distinctive
+//! native paths, LiteLLM's custom response headers, well-known
+//! upstream hostnames, distinct `finish_reason` values, plus small
+//! request- and response-body samples — gives a definitive label for
+//! almost every endpoint at near-zero query cost.
+//!
+//! Signal table (highest confidence first):
+//!
+//! | App         | Primary signal                                                  |
+//! |-------------|-----------------------------------------------------------------|
+//! | `ollama`    | path `/api/chat` / `/api/generate` / `/api/tags` (native API)    |
+//! | `llamacpp`  | path `/completion` / `/tokenize` / `/props` (non-`/v1/...`)      |
+//! | `sglang`    | path `/generate` / `/health_generate` / `/get_server_info` /     |
+//! |             | `/flush_cache` / `/encode` (SGLang's own surface alongside       |
+//! |             | OpenAI-compat)                                                   |
+//! | `vllm`      | path `/version` / `/v1/score` (vLLM-specific endpoints)          |
+//! | `litellm`   | any `x-litellm-*` response header (LiteLLM stamps these)         |
+//! | `openai`    | request `Host: api.openai.com`                                   |
+//! | `anthropic` | request `Host: api.anthropic.com`                                |
+//! | `sglang`    | `finish_reason` ∈ {`matched_stop`, `matched_eos`, `stop_str`}    |
+//! |             | (SGLang's stop-condition machinery; vLLM doesn't have these)     |
+//! | `vllm`      | response body has `"id":"chatcmpl-tool-` (vLLM tool_call_id) OR  |
+//! |             | `"system_fingerprint":"fp_…"` (vLLM only)                        |
+//! | `vllm`      | request body contains `chatcmpl-tool-` — agentic flows echo the  |
+//! |             | server's prior tool_call_id back in assistant history; works     |
+//! |             | even when responses are SSE-streamed (response_body is NULL)     |
+//! | `sglang`    | uvicorn endpoint, model name starts with `glm` or `deepseek`     |
+//! |             | (SGLang is the reference deployment for those families)         |
+//! | `vllm`      | uvicorn fallback — vLLM is by far the more common openai-compat  |
+//! |             | server, better default than `unknown`                            |
+//! | `None`      | nothing matches (no Server header, no distinctive paths)         |
+
+use std::collections::HashMap;
+
+/// Classify one Services-page row from the cheap signals we can pull
+/// out of the SQL aggregate. Returns the app label (lowercase, stable
+/// — surfaces straight in the API JSON / UI badges).
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn classify_app(
+    server_header: Option<&str>,
+    raw_response_headers_json: Option<&str>,
+    raw_request_headers_json: Option<&str>,
+    request_paths: &[String],
+    finish_reasons: &[String],
+    models: &[String],
+    sample_request_body: Option<&str>,
+    sample_response_body: Option<&str>,
+) -> Option<String> {
+    // -- Native non-OpenAI surface, very high confidence. --
+    if request_paths.iter().any(|p| {
+        let p = p.to_ascii_lowercase();
+        p.starts_with("/api/chat")
+            || p.starts_with("/api/generate")
+            || p.starts_with("/api/tags")
+            || p.starts_with("/api/show")
+            || p == "/api/version"
+    }) {
+        return Some("ollama".to_string());
+    }
+    if request_paths.iter().any(|p| {
+        // llama.cpp's native completion paths sit at the root, not
+        // under /v1/. `/v1/...` paths exist too (OpenAI-compat) but
+        // by themselves don't distinguish llama.cpp from vLLM.
+        matches!(
+            p.as_str(),
+            "/completion" | "/tokenize" | "/detokenize" | "/props"
+        )
+    }) {
+        return Some("llamacpp".to_string());
+    }
+
+    // -- SGLang-specific paths. Even when serving OpenAI-compat,
+    // -- SGLang exposes /generate / /health_generate / /flush_cache /
+    // -- /get_server_info / /encode at the same port.
+    if request_paths.iter().any(|p| {
+        matches!(
+            p.as_str(),
+            "/generate"
+                | "/health_generate"
+                | "/get_server_info"
+                | "/flush_cache"
+                | "/encode"
+                | "/start_profile"
+                | "/stop_profile"
+        )
+    }) {
+        return Some("sglang".to_string());
+    }
+
+    // -- vLLM-specific paths. /version returns vLLM's version JSON.
+    // -- /v1/score is reranking, vLLM-only.
+    if request_paths
+        .iter()
+        .any(|p| p == "/version" || p.starts_with("/v1/score"))
+    {
+        return Some("vllm".to_string());
+    }
+
+    // -- LiteLLM stamps its own response headers.
+    if let Some(json) = raw_response_headers_json {
+        let lower = json.to_ascii_lowercase();
+        if lower.contains("x-litellm-") || lower.contains("\"server\":\"litellm") {
+            return Some("litellm".to_string());
+        }
+    }
+
+    // -- Upstream hostnames from the request side. Captured request_headers
+    // -- carries `Host:` even when we're routed through a sniffer that
+    // -- doesn't terminate TLS — the parser stashes the inner host.
+    if let Some(host) = extract_host_header(raw_request_headers_json) {
+        let host = host.to_ascii_lowercase();
+        if host == "api.openai.com" || host.ends_with(".api.openai.com") {
+            return Some("openai".to_string());
+        }
+        if host == "api.anthropic.com" || host.ends_with(".api.anthropic.com") {
+            return Some("anthropic".to_string());
+        }
+        if host == "generativelanguage.googleapis.com" {
+            return Some("gemini".to_string());
+        }
+    }
+
+    // -- SGLang-exclusive finish_reasons. Captured for both streaming
+    // -- and non-streaming calls (extracted from SSE for the former).
+    // -- `matched_stop` / `matched_eos` / `stop_str` come out of SGLang's
+    // -- stop-condition machinery and vLLM doesn't have them.
+    if finish_reasons.iter().any(|fr| {
+        let l = fr.to_ascii_lowercase();
+        l == "matched_stop" || l == "matched_eos" || l == "stop_str"
+    }) {
+        return Some("sglang".to_string());
+    }
+
+    // -- vLLM signatures in the response body sample. Two patterns:
+    // --   1. tool_call_id `"id":"chatcmpl-tool-<hex>"` — vLLM's
+    // --      tool parser uses this format; SGLang follows OpenAI's
+    // --      `call_<hex>`.
+    // --   2. `system_fingerprint":"fp_<hex>"` — vLLM emits this
+    // --      field (mirroring OpenAI's); SGLang leaves it null.
+    let vllm_in_response_body = sample_response_body
+        .map(|body| {
+            body.contains("\"id\":\"chatcmpl-tool-")
+                || body.contains("\"id\": \"chatcmpl-tool-")
+                || body.contains("\"system_fingerprint\":\"fp_")
+                || body.contains("\"system_fingerprint\": \"fp_")
+        })
+        .unwrap_or(false);
+    if vllm_in_response_body {
+        return Some("vllm".to_string());
+    }
+
+    // -- vLLM signature in the request body. Agentic flows include
+    // -- prior `assistant.tool_calls[].id` values in their message
+    // -- history, and vLLM-generated tool_call_ids carry the
+    // -- `chatcmpl-tool-` prefix. Works even when the response is
+    // -- SSE-streamed (response_body is NULL).
+    if let Some(body) = sample_request_body {
+        if body.contains("chatcmpl-tool-") {
+            return Some("vllm".to_string());
+        }
+    }
+
+    // -- Server header check. uvicorn matches BOTH vLLM and SGLang;
+    // -- the multi-model tiebreaker handles LiteLLM, the model-name
+    // -- heuristic handles SGLang's GLM/DeepSeek family deployments,
+    // -- and everything else falls through to vLLM.
+    let is_uvicorn = server_header
+        .map(|sh| {
+            let l = sh.to_ascii_lowercase();
+            l.contains("uvicorn") || l.contains("hypercorn")
+        })
+        .unwrap_or(false);
+    let has_litellm_server = server_header
+        .map(|sh| sh.to_ascii_lowercase().starts_with("litellm"))
+        .unwrap_or(false);
+    let has_ollama_server = server_header
+        .map(|sh| sh.to_ascii_lowercase().contains("ollama"))
+        .unwrap_or(false);
+
+    if has_ollama_server {
+        return Some("ollama".to_string());
+    }
+    if has_litellm_server {
+        return Some("litellm".to_string());
+    }
+
+    if is_uvicorn {
+        // The "uvicorn + ≥3 distinct models → litellm" tiebreaker
+        // used to live here, but it was window-width-sensitive: at
+        // 7 d a vLLM serving Qwen3.5-35B accumulates 3-4 stray model
+        // names (`text-embedding-ada-002`, `test`, …) from rogue
+        // clients and gets misclassified. The signal isn't strong
+        // enough to overrule the body / path / header evidence we
+        // already weighed above. Removed.
+
+        // Model-name heuristic. SGLang is the reference deployment for
+        // the Zhipu GLM family and the DeepSeek family in production;
+        // both are non-trivial to run on vLLM (custom kernels, MLA,
+        // etc.). Matches the user's prod corpus exactly.
+        let lower_models: Vec<String> = models.iter().map(|m| m.to_ascii_lowercase()).collect();
+        let smells_like_sglang = lower_models.iter().any(|m| {
+            m.starts_with("glm")
+                || m.contains("/glm")
+                || m.starts_with("deepseek")
+                || m.contains("/deepseek")
+        });
+        if smells_like_sglang {
+            return Some("sglang".to_string());
+        }
+
+        return Some("vllm".to_string());
+    }
+
+    None
+}
+
+/// Pull the `Server` header value out of a serialized `Vec<(String,
+/// String)>` JSON blob (the same format used by the rest of the
+/// codebase — see `ts_protocol::model::HttpResponseData::headers`).
+///
+/// Returns `None` if the blob is missing, doesn't parse, or has no
+/// matching header.
+pub(crate) fn extract_server_header(raw_response_headers_json: Option<&str>) -> Option<String> {
+    let raw = raw_response_headers_json?;
+    let parsed: Vec<(String, String)> = serde_json::from_str(raw).ok()?;
+    parsed
+        .into_iter()
+        .find(|(k, _)| k.eq_ignore_ascii_case("server"))
+        .map(|(_, v)| v)
+}
+
+/// Like `extract_server_header` but for request `Host`. We use it to
+/// distinguish proxy traffic terminating at e.g. `api.openai.com`
+/// (where the `Host` header is the give-away) from same-IP
+/// self-hosted services.
+fn extract_host_header(raw_request_headers_json: Option<&str>) -> Option<String> {
+    let raw = raw_request_headers_json?;
+    let parsed: Vec<(String, String)> = serde_json::from_str(raw).ok()?;
+    parsed
+        .into_iter()
+        .find(|(k, _)| k.eq_ignore_ascii_case("host"))
+        .map(|(_, v)| v)
+}
+
+#[allow(dead_code)] // exposed for tests in this module
+fn _headermap(items: &[(&str, &str)]) -> String {
+    let v: Vec<(String, String)> = items
+        .iter()
+        .map(|(k, v)| (k.to_string(), v.to_string()))
+        .collect();
+    serde_json::to_string(&v).unwrap()
+}
+
+#[allow(dead_code)] // exposed for tests in this module
+fn _empty_map() -> HashMap<String, String> {
+    HashMap::new()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn hdrs(items: &[(&str, &str)]) -> String {
+        _headermap(items)
+    }
+
+    /// Empty everything — shared test default. Use overrides to inject
+    /// the specific signal each case is exercising.
+    struct C {
+        server_header: Option<String>,
+        raw_response_headers_json: Option<String>,
+        raw_request_headers_json: Option<String>,
+        request_paths: Vec<String>,
+        finish_reasons: Vec<String>,
+        models: Vec<String>,
+        sample_request_body: Option<String>,
+        sample_response_body: Option<String>,
+    }
+    impl Default for C {
+        fn default() -> Self {
+            Self {
+                server_header: None,
+                raw_response_headers_json: None,
+                raw_request_headers_json: None,
+                request_paths: vec![],
+                finish_reasons: vec![],
+                models: vec![],
+                sample_request_body: None,
+                sample_response_body: None,
+            }
+        }
+    }
+    fn run(c: &C) -> Option<String> {
+        classify_app(
+            c.server_header.as_deref(),
+            c.raw_response_headers_json.as_deref(),
+            c.raw_request_headers_json.as_deref(),
+            &c.request_paths,
+            &c.finish_reasons,
+            &c.models,
+            c.sample_request_body.as_deref(),
+            c.sample_response_body.as_deref(),
+        )
+    }
+
+    #[test]
+    fn ollama_via_native_path() {
+        let c = C {
+            request_paths: vec!["/api/chat".into()],
+            ..Default::default()
+        };
+        assert_eq!(run(&c).as_deref(), Some("ollama"));
+    }
+
+    #[test]
+    fn ollama_via_server_header_with_oai_path() {
+        let c = C {
+            server_header: Some("ollama/0.1.45".into()),
+            raw_response_headers_json: Some(hdrs(&[("server", "ollama/0.1.45")])),
+            request_paths: vec!["/v1/chat/completions".into()],
+            models: vec!["llama3".into()],
+            ..Default::default()
+        };
+        assert_eq!(run(&c).as_deref(), Some("ollama"));
+    }
+
+    #[test]
+    fn llamacpp_via_completion_path() {
+        let c = C {
+            request_paths: vec!["/completion".into()],
+            ..Default::default()
+        };
+        assert_eq!(run(&c).as_deref(), Some("llamacpp"));
+    }
+
+    #[test]
+    fn sglang_via_native_path() {
+        // SGLang exposes /generate alongside its OpenAI-compat surface.
+        let c = C {
+            server_header: Some("uvicorn".into()),
+            raw_response_headers_json: Some(hdrs(&[("server", "uvicorn")])),
+            request_paths: vec!["/v1/chat/completions".into(), "/generate".into()],
+            models: vec!["llama-3-8b".into()],
+            ..Default::default()
+        };
+        assert_eq!(run(&c).as_deref(), Some("sglang"));
+    }
+
+    #[test]
+    fn sglang_via_health_generate_path() {
+        let c = C {
+            request_paths: vec!["/health_generate".into()],
+            ..Default::default()
+        };
+        assert_eq!(run(&c).as_deref(), Some("sglang"));
+    }
+
+    #[test]
+    fn sglang_via_matched_stop_finish_reason() {
+        // Streaming endpoint — no response body, but SSE-extracted
+        // finish_reason `matched_stop` exposes SGLang.
+        let c = C {
+            server_header: Some("uvicorn".into()),
+            raw_response_headers_json: Some(hdrs(&[("server", "uvicorn")])),
+            request_paths: vec!["/v1/chat/completions".into()],
+            finish_reasons: vec!["stop".into(), "matched_stop".into()],
+            models: vec!["mystery-model".into()],
+            ..Default::default()
+        };
+        assert_eq!(run(&c).as_deref(), Some("sglang"));
+    }
+
+    #[test]
+    fn vllm_via_version_path() {
+        let c = C {
+            request_paths: vec!["/v1/chat/completions".into(), "/version".into()],
+            ..Default::default()
+        };
+        assert_eq!(run(&c).as_deref(), Some("vllm"));
+    }
+
+    #[test]
+    fn vllm_via_response_body_tool_call_id() {
+        let c = C {
+            server_header: Some("uvicorn".into()),
+            raw_response_headers_json: Some(hdrs(&[("server", "uvicorn")])),
+            request_paths: vec!["/v1/chat/completions".into()],
+            models: vec!["qwen35-27b".into()],
+            sample_response_body: Some(
+                r#"{"id":"chatcmpl-abc","choices":[{"message":{"tool_calls":[{"id":"chatcmpl-tool-deadbeef","type":"function"}]}}]}"#.into(),
+            ),
+            ..Default::default()
+        };
+        assert_eq!(run(&c).as_deref(), Some("vllm"));
+    }
+
+    #[test]
+    fn vllm_via_response_body_system_fingerprint() {
+        let c = C {
+            server_header: Some("uvicorn".into()),
+            raw_response_headers_json: Some(hdrs(&[("server", "uvicorn")])),
+            request_paths: vec!["/v1/chat/completions".into()],
+            models: vec!["qwen35-27b".into()],
+            sample_response_body: Some(
+                r#"{"id":"chatcmpl-x","system_fingerprint":"fp_abc123","choices":[]}"#.into(),
+            ),
+            ..Default::default()
+        };
+        assert_eq!(run(&c).as_deref(), Some("vllm"));
+    }
+
+    #[test]
+    fn vllm_via_request_body_tool_history() {
+        // Streaming-only endpoint — response_body is null. Agentic
+        // round N+1 sends prior assistant.tool_calls history back to
+        // the server, and vLLM's tool_call_ids carry `chatcmpl-tool-`.
+        let c = C {
+            server_header: Some("uvicorn".into()),
+            raw_response_headers_json: Some(hdrs(&[("server", "uvicorn")])),
+            request_paths: vec!["/v1/chat/completions".into()],
+            models: vec!["mystery-model".into()],
+            sample_request_body: Some(
+                r#"{"messages":[{"role":"assistant","tool_calls":[{"id":"chatcmpl-tool-deadbeef","type":"function","function":{"name":"x"}}]}]}"#.into(),
+            ),
+            ..Default::default()
+        };
+        assert_eq!(run(&c).as_deref(), Some("vllm"));
+    }
+
+    #[test]
+    fn litellm_via_response_header() {
+        let c = C {
+            server_header: Some("uvicorn".into()),
+            raw_response_headers_json: Some(hdrs(&[
+                ("server", "uvicorn"),
+                ("x-litellm-call-id", "abc123"),
+            ])),
+            request_paths: vec!["/v1/chat/completions".into()],
+            models: vec!["gpt-4o".into()],
+            ..Default::default()
+        };
+        assert_eq!(run(&c).as_deref(), Some("litellm"));
+    }
+
+    #[test]
+    fn sglang_via_glm_model_heuristic() {
+        // Single GLM model on uvicorn, no LiteLLM signal, no
+        // discriminating finish_reason. Falls back to the model-name
+        // heuristic — Zhipu's reference deployment is SGLang.
+        let c = C {
+            server_header: Some("uvicorn".into()),
+            raw_response_headers_json: Some(hdrs(&[("server", "uvicorn")])),
+            request_paths: vec!["/v1/chat/completions".into()],
+            models: vec!["GLM-5.1".into()],
+            ..Default::default()
+        };
+        assert_eq!(run(&c).as_deref(), Some("sglang"));
+    }
+
+    #[test]
+    fn sglang_via_deepseek_model_heuristic() {
+        let c = C {
+            server_header: Some("uvicorn".into()),
+            raw_response_headers_json: Some(hdrs(&[("server", "uvicorn")])),
+            request_paths: vec!["/v1/chat/completions".into()],
+            models: vec!["deepseek-v3".into()],
+            ..Default::default()
+        };
+        assert_eq!(run(&c).as_deref(), Some("sglang"));
+    }
+
+    #[test]
+    fn vllm_default_for_single_model_uvicorn() {
+        // 1 model, uvicorn, no LiteLLM signals, no SGLang signals →
+        // pick the more common openai-compat server.
+        let c = C {
+            server_header: Some("uvicorn".into()),
+            raw_response_headers_json: Some(hdrs(&[("server", "uvicorn")])),
+            request_paths: vec!["/v1/chat/completions".into()],
+            models: vec!["qwen35-27b".into()],
+            ..Default::default()
+        };
+        assert_eq!(run(&c).as_deref(), Some("vllm"));
+    }
+
+    #[test]
+    fn openai_via_request_host() {
+        let c = C {
+            raw_request_headers_json: Some(hdrs(&[("host", "api.openai.com")])),
+            request_paths: vec!["/v1/chat/completions".into()],
+            models: vec!["gpt-4".into()],
+            ..Default::default()
+        };
+        assert_eq!(run(&c).as_deref(), Some("openai"));
+    }
+
+    #[test]
+    fn anthropic_via_request_host() {
+        let c = C {
+            raw_request_headers_json: Some(hdrs(&[("host", "api.anthropic.com")])),
+            request_paths: vec!["/v1/messages".into()],
+            models: vec!["claude-3-5-sonnet".into()],
+            ..Default::default()
+        };
+        assert_eq!(run(&c).as_deref(), Some("anthropic"));
+    }
+
+    #[test]
+    fn unknown_when_no_signals() {
+        let c = C::default();
+        assert!(run(&c).is_none());
+    }
+
+    #[test]
+    fn ollama_path_wins_over_uvicorn_server() {
+        let c = C {
+            server_header: Some("uvicorn".into()),
+            raw_response_headers_json: Some(hdrs(&[("server", "uvicorn")])),
+            request_paths: vec!["/api/chat".into()],
+            models: vec!["llama3".into()],
+            ..Default::default()
+        };
+        assert_eq!(run(&c).as_deref(), Some("ollama"));
+    }
+
+    #[test]
+    fn sglang_finish_reason_beats_glm_heuristic_consistency() {
+        // SGLang finish_reason AND GLM model — should still be SGLang.
+        let c = C {
+            server_header: Some("uvicorn".into()),
+            raw_response_headers_json: Some(hdrs(&[("server", "uvicorn")])),
+            request_paths: vec!["/v1/chat/completions".into()],
+            finish_reasons: vec!["matched_stop".into()],
+            models: vec!["GLM-5.1".into()],
+            ..Default::default()
+        };
+        assert_eq!(run(&c).as_deref(), Some("sglang"));
+    }
+
+    #[test]
+    fn extract_server_header_finds_match() {
+        let h = hdrs(&[("content-type", "application/json"), ("Server", "uvicorn")]);
+        assert_eq!(extract_server_header(Some(&h)).as_deref(), Some("uvicorn"));
+    }
+
+    #[test]
+    fn extract_server_header_handles_missing() {
+        let h = hdrs(&[("content-type", "application/json")]);
+        assert!(extract_server_header(Some(&h)).is_none());
+    }
+}
diff --git a/server/ts-storage-duckdb/src/calls.rs b/server/ts-storage-duckdb/src/calls.rs
index 2eae1bfd..d166a3fa 100644
--- a/server/ts-storage-duckdb/src/calls.rs
+++ b/server/ts-storage-duckdb/src/calls.rs
@@ -374,6 +374,14 @@ impl DuckDbBackend {
                     .collect();
                 where_parts.push(format!("client_ip IN ({})", list.join(", ")));
             }
+            if !query.server_ports.is_empty() {
+                let list: Vec<String> = query
+                    .server_ports
+                    .iter()
+                    .map(|p| p.to_string())
+                    .collect();
+                where_parts.push(format!("server_port IN ({})", list.join(", ")));
+            }
             if let Some(substr) = query
                 .request_path_contains
                 .as_deref()
@@ -777,6 +785,7 @@ mod tests {
             status_codes: vec![],
             finish_reasons: vec![],
             client_ips: vec![],
+            server_ports: vec![],
             request_path_contains: None,
             is_stream: None,
             sort_by: "request_time".to_string(),
@@ -820,6 +829,7 @@ mod tests {
             status_codes: vec![429],
             finish_reasons: vec![],
             client_ips: vec![],
+            server_ports: vec![],
             request_path_contains: None,
             is_stream: None,
             sort_by: "request_time".to_string(),
diff --git a/server/ts-storage-duckdb/src/lib.rs b/server/ts-storage-duckdb/src/lib.rs
index 050f718d..26d53246 100644
--- a/server/ts-storage-duckdb/src/lib.rs
+++ b/server/ts-storage-duckdb/src/lib.rs
@@ -1,3 +1,4 @@
+mod apps;
 mod calls;
 #[cfg(test)]
 mod concurrent_tests;
@@ -163,6 +164,31 @@ impl StorageBackend for DuckDbBackend {
         DuckDbBackend::query_metrics_models(self, query).await
     }
 
+    async fn query_services(&self, query: &ServicesQuery) -> Result<Vec<ServiceRow>> {
+        DuckDbBackend::query_services(self, query).await
+    }
+
+    async fn query_services_topology(
+        &self,
+        query: &ServicesTopologyQuery,
+    ) -> Result<ServicesTopology> {
+        DuckDbBackend::query_services_topology(self, query).await
+    }
+
+    async fn query_agent_summary(
+        &self,
+        query: &AgentSummaryQuery,
+    ) -> Result<Vec<AgentKindSummary>> {
+        DuckDbBackend::query_agent_summary(self, query).await
+    }
+
+    async fn query_agent_activity(
+        &self,
+        query: &AgentActivityQuery,
+    ) -> Result<Vec<AgentActivityPoint>> {
+        DuckDbBackend::query_agent_activity(self, query).await
+    }
+
     async fn query_finish_reasons(
         &self,
         query: &FinishReasonsQuery,
diff --git a/server/ts-storage-duckdb/src/metrics.rs b/server/ts-storage-duckdb/src/metrics.rs
index 6bdbb7e5..65d2c1a2 100644
--- a/server/ts-storage-duckdb/src/metrics.rs
+++ b/server/ts-storage-duckdb/src/metrics.rs
@@ -8,7 +8,8 @@ use ts_metrics::model::{LlmFinishMetric, LlmMetric};
 use ts_storage::query::*;
 
 use crate::util::{
-    build_dimension_where, build_dimension_where_for_group, sql_in_list, us_to_timestamp,
+    build_dimension_where, build_dimension_where_for_group, parse_json_string_list, sql_in_list,
+    us_to_timestamp,
 };
 use crate::DuckDbBackend;
 
@@ -22,6 +23,18 @@ struct PreparedMetric {
     inner: LlmMetric,
 }
 
+/// Body / header sample bundle used by app classification, fetched
+/// independently from the main per-endpoint aggregation so the heavy
+/// body scan can run on a clipped window (see `fetch_app_samples`).
+pub(crate) struct AppSample {
+    pub request_paths: Vec<String>,
+    pub finish_reasons: Vec<String>,
+    pub sample_response_headers: Option<String>,
+    pub sample_request_headers: Option<String>,
+    pub sample_request_body: Option<String>,
+    pub sample_response_body: Option<String>,
+}
+
 fn prepare_metric(m: LlmMetric) -> PreparedMetric {
     PreparedMetric {
         timestamp: Value::Timestamp(TimeUnit::Microsecond, m.timestamp_us),
@@ -803,6 +816,957 @@ impl DuckDbBackend {
         .await
         .map_err(|e| AppError::Storage(format!("spawn_blocking failed: {e}")))?
     }
+
+    /// Per-endpoint body / header sample, used by app classification.
+    /// Keyed by `(server_ip, server_port)`.
+    pub(crate) fn fetch_app_samples(
+        conn: &duckdb::Connection,
+        window_start_us: i64,
+        window_end_us: i64,
+    ) -> Result<std::collections::HashMap<(String, u16), AppSample>> {
+        // Body columns are heavy (16-32 KB / row); a per-group
+        // arg_max(body, ...) FILTER (LENGTH(body) BETWEEN ...) forces
+        // DuckDB to materialize every body in the window — 5+ GB on a
+        // 7-day range, ~17 s wall-clock.
+        //
+        // Strategy: pull only the top-N (=5) most-recent rows per
+        // (server_ip, server_port) via a row_number window
+        // partitioning trick. DuckDB can keep the rank in-place and
+        // only emit those few rows' bodies — measured ~1.3 s on the
+        // same 7-day data. We further clip the scan window to the
+        // last 24 h (app classification doesn't change over the
+        // wider window) so the row_number scan stays narrow.
+        //
+        // In Rust we look through the 5 returned rows per endpoint
+        // for the first one whose body matches our shape filter
+        // (100-32768 B and starts with `{`) — equivalent to the old
+        // SQL FILTER without paying the full-scan cost.
+        const SAMPLE_WINDOW_US: i64 = 24 * 60 * 60 * 1_000_000;
+        let sample_start_us = std::cmp::max(window_start_us, window_end_us - SAMPLE_WINDOW_US);
+        let sample_start = us_to_timestamp(sample_start_us);
+        let sample_end = us_to_timestamp(window_end_us);
+
+        // The outer aggregation over the same window gives us
+        // request_paths / finish_reasons distinct lists — those
+        // columns are small so this is cheap (< 0.2 s for 7 d).
+        let dim_sql = "SELECT
+                server_ip,
+                server_port,
+                CAST(list_distinct(array_agg(request_path))[1:16] AS JSON)::VARCHAR     AS paths_json,
+                CAST(list_distinct(array_agg(finish_reason))[1:32] AS JSON)::VARCHAR    AS finish_reasons_json
+             FROM llm_calls
+             WHERE request_time >= ? AND request_time < ?
+             GROUP BY server_ip, server_port";
+
+        let mut out: std::collections::HashMap<(String, u16), AppSample> =
+            std::collections::HashMap::new();
+        {
+            let mut stmt = conn.prepare(dim_sql).map_err(|e| {
+                AppError::Storage(format!("failed to prepare dim sample query: {e}"))
+            })?;
+            let mut rs = stmt
+                .query(duckdb::params![sample_start.clone(), sample_end.clone()])
+                .map_err(|e| {
+                    AppError::Storage(format!("failed to execute dim sample query: {e}"))
+                })?;
+            while let Some(row) = rs
+                .next()
+                .map_err(|e| AppError::Storage(format!("row error: {e}")))?
+            {
+                let server_ip: String = row
+                    .get(0)
+                    .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+                let server_port: u16 = row
+                    .get(1)
+                    .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+                let paths_json: Option<String> = row
+                    .get(2)
+                    .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+                let finish_reasons_json: Option<String> = row
+                    .get(3)
+                    .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+                out.insert(
+                    (server_ip, server_port),
+                    AppSample {
+                        request_paths: parse_json_string_list(paths_json.as_deref()),
+                        finish_reasons: parse_json_string_list(finish_reasons_json.as_deref()),
+                        sample_response_headers: None,
+                        sample_request_headers: None,
+                        sample_request_body: None,
+                        sample_response_body: None,
+                    },
+                );
+            }
+        }
+
+        // Body / header sampling — top-5 most-recent rows per
+        // endpoint. We filter for shape (`headers LIKE '[%'`,
+        // `body LIKE '{%'`) in Rust below.
+        let body_sql = "SELECT server_ip, server_port,
+                response_headers, request_headers, request_body, response_body
+             FROM (
+                SELECT server_ip, server_port,
+                       response_headers, request_headers,
+                       request_body, response_body,
+                       ROW_NUMBER() OVER (
+                           PARTITION BY server_ip, server_port
+                           ORDER BY request_time DESC
+                       ) AS rn
+                FROM llm_calls
+                WHERE request_time >= ? AND request_time < ?
+             ) WHERE rn <= 5";
+
+        let mut stmt = conn.prepare(body_sql).map_err(|e| {
+            AppError::Storage(format!("failed to prepare body sample query: {e}"))
+        })?;
+        let mut rs = stmt
+            .query(duckdb::params![sample_start, sample_end])
+            .map_err(|e| {
+                AppError::Storage(format!("failed to execute body sample query: {e}"))
+            })?;
+        while let Some(row) = rs
+            .next()
+            .map_err(|e| AppError::Storage(format!("row error: {e}")))?
+        {
+            let server_ip: String = row
+                .get(0)
+                .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+            let server_port: u16 = row
+                .get(1)
+                .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+            let resp_h: Option<String> = row
+                .get(2)
+                .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+            let req_h: Option<String> = row
+                .get(3)
+                .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+            let req_b: Option<String> = row
+                .get(4)
+                .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+            let resp_b: Option<String> = row
+                .get(5)
+                .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+
+            let entry = out.entry((server_ip, server_port)).or_insert_with(|| AppSample {
+                request_paths: Vec::new(),
+                finish_reasons: Vec::new(),
+                sample_response_headers: None,
+                sample_request_headers: None,
+                sample_request_body: None,
+                sample_response_body: None,
+            });
+
+            // First-match-wins per field: row_number ORDER BY
+            // request_time DESC means the first row we see for an
+            // endpoint is the most recent. Skip if we already have a
+            // good sample.
+            if entry.sample_response_headers.is_none() {
+                if let Some(s) = resp_h.filter(|s| s.starts_with('[')) {
+                    entry.sample_response_headers = Some(s);
+                }
+            }
+            if entry.sample_request_headers.is_none() {
+                if let Some(s) = req_h.filter(|s| s.starts_with('[')) {
+                    entry.sample_request_headers = Some(s);
+                }
+            }
+            if entry.sample_request_body.is_none() {
+                if let Some(s) =
+                    req_b.filter(|s| (100..=32768).contains(&s.len()) && s.starts_with('{'))
+                {
+                    entry.sample_request_body = Some(s);
+                }
+            }
+            if entry.sample_response_body.is_none() {
+                if let Some(s) =
+                    resp_b.filter(|s| (30..=8192).contains(&s.len()) && s.starts_with('{'))
+                {
+                    entry.sample_response_body = Some(s);
+                }
+            }
+        }
+        Ok(out)
+    }
+
+    /// "Services" view — aggregate `llm_calls` by `(server_ip,
+    /// server_port)`. See `StorageBackend::query_services` for the
+    /// motivation (port is not on `llm_metrics`).
+    pub(crate) async fn query_services(
+        &self,
+        query: &ServicesQuery,
+    ) -> Result<Vec<ServiceRow>> {
+        const VALID_SORT_FIELDS: &[&str] = &[
+            "call_count",
+            "error_count",
+            "total_input_tokens",
+            "total_output_tokens",
+            "ttft_avg_ms",
+            "ttft_p95_ms",
+            "e2e_avg_ms",
+            "e2e_p95_ms",
+            "last_seen_ms",
+            "first_seen_ms",
+            "server_ip",
+            "server_port",
+        ];
+        if !VALID_SORT_FIELDS.contains(&query.sort_by.as_str()) {
+            return Err(AppError::Storage(format!(
+                "invalid sort_by field: {}",
+                query.sort_by
+            )));
+        }
+        let sort_order = if query.sort_order.to_uppercase() == "ASC" {
+            "ASC"
+        } else {
+            "DESC"
+        };
+
+        let conn = self.read_pool.acquire().await?;
+        let query = query.clone();
+        let sort_order = sort_order.to_string();
+
+        tokio::task::spawn_blocking(move || {
+            let start_ts = us_to_timestamp(query.time_range.start_us);
+            let end_ts = us_to_timestamp(query.time_range.end_us);
+            let sort_by = &query.sort_by;
+            let limit = query.limit;
+
+            // Notes on the SQL:
+            //   * `list_distinct(array_agg(model))` collects distinct
+            //     values, then `[1:32]` caps the list — protects against a
+            //     pathological row producing thousands of values that
+            //     would each show up here.
+            //   * Percentiles use `quantile_cont(col, 0.95)` (DuckDB's
+            //     name for PERCENTILE_CONT). NULL inputs are skipped
+            //     automatically so streaming-only calls with no
+            //     `e2e_latency_ms` don't poison the result.
+            //   * `epoch_ms(MIN(request_time))` returns Unix-epoch ms as
+            //     i64 — matches the convention used elsewhere in the
+            //     `/api/llm-calls` and `/api/agent-turns` payloads.
+            // List-of-VARCHAR columns come back as JSON strings (DuckDB's
+            // rust binding has no `FromSql` for `Vec<String>`). We cast
+            // to JSON in SQL and then `parse_json_string_list` them on
+            // the Rust side — same pattern used by `agent_turns.models_used`.
+            //
+            // For app classification we sample one `request_headers` /
+            // `response_headers` blob per group. `arg_min(col,
+            // LENGTH(col)) FILTER (...)` picks the smallest non-null
+            // value — predictable across re-runs and tiny enough that
+            // streaming back to Rust costs nothing.
+            // Body / header sampling for app classification runs as
+            // a separate, time-clipped query — see fetch_app_samples.
+            // Keeps the main per-endpoint aggregation off the heavy
+            // body columns so a 7-day window stays sub-second
+            // instead of pegging at 17s.
+            let samples = DuckDbBackend::fetch_app_samples(
+                &conn,
+                query.time_range.start_us,
+                query.time_range.end_us,
+            )?;
+
+            let sql = format!(
+                "SELECT
+                    server_ip,
+                    server_port,
+                    CAST(list_distinct(array_agg(model))[1:32] AS JSON)::VARCHAR    AS models_json,
+                    CAST(list_distinct(array_agg(wire_api))[1:8] AS JSON)::VARCHAR  AS wire_apis_json,
+                    CAST(list_distinct(array_agg(request_path))[1:16] AS JSON)::VARCHAR AS paths_json,
+                    COUNT(*)                                  AS call_count,
+                    COALESCE(SUM(CASE WHEN status_code >= 400 THEN 1 ELSE 0 END), 0)::UBIGINT AS error_count,
+                    COALESCE(SUM(CASE WHEN is_stream THEN 1 ELSE 0 END), 0)::UBIGINT          AS stream_count,
+                    COALESCE(SUM(input_tokens), 0)::UBIGINT   AS total_input_tokens,
+                    COALESCE(SUM(output_tokens), 0)::UBIGINT  AS total_output_tokens,
+                    AVG(ttft_ms)                              AS ttft_avg_ms,
+                    quantile_cont(ttft_ms, 0.95)              AS ttft_p95_ms,
+                    AVG(e2e_latency_ms)                       AS e2e_avg_ms,
+                    quantile_cont(e2e_latency_ms, 0.95)       AS e2e_p95_ms,
+                    epoch_ms(MIN(request_time))               AS first_seen_ms,
+                    epoch_ms(MAX(request_time))               AS last_seen_ms
+                 FROM llm_calls
+                 WHERE request_time >= ? AND request_time < ?
+                 GROUP BY server_ip, server_port
+                 ORDER BY {sort_by} {sort_order}
+                 LIMIT {limit}"
+            );
+
+            let mut stmt = conn
+                .prepare(&sql)
+                .map_err(|e| AppError::Storage(format!("failed to prepare services query: {e}")))?;
+            let mut query_rows = stmt
+                .query(duckdb::params![start_ts, end_ts])
+                .map_err(|e| AppError::Storage(format!("failed to execute services query: {e}")))?;
+
+            let mut rows = Vec::new();
+            while let Some(row) = query_rows
+                .next()
+                .map_err(|e| AppError::Storage(format!("row error: {e}")))?
+            {
+                let server_ip: String = row
+                    .get(0)
+                    .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+                let server_port: u16 = row
+                    .get(1)
+                    .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+                let models_json: Option<String> = row
+                    .get(2)
+                    .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+                let wire_apis_json: Option<String> = row
+                    .get(3)
+                    .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+                let paths_json: Option<String> = row
+                    .get(4)
+                    .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+
+                let models = parse_json_string_list(models_json.as_deref());
+                let wire_apis = parse_json_string_list(wire_apis_json.as_deref());
+                // Default request_paths comes from the main window;
+                // if the endpoint also has a recent sample, prefer
+                // the recent paths (they're already in `samples`).
+                let mut request_paths = parse_json_string_list(paths_json.as_deref());
+
+                let sample = samples.get(&(server_ip.clone(), server_port));
+                let finish_reasons = sample.map(|s| s.finish_reasons.clone()).unwrap_or_default();
+                if let Some(s) = sample {
+                    if !s.request_paths.is_empty() {
+                        request_paths = s.request_paths.clone();
+                    }
+                }
+                let sample_response_headers = sample.and_then(|s| s.sample_response_headers.as_deref());
+                let sample_request_headers = sample.and_then(|s| s.sample_request_headers.as_deref());
+                let sample_request_body = sample.and_then(|s| s.sample_request_body.as_deref());
+                let sample_response_body = sample.and_then(|s| s.sample_response_body.as_deref());
+
+                let server_header = crate::apps::extract_server_header(sample_response_headers);
+                let app = crate::apps::classify_app(
+                    server_header.as_deref(),
+                    sample_response_headers,
+                    sample_request_headers,
+                    &request_paths,
+                    &finish_reasons,
+                    &models,
+                    sample_request_body,
+                    sample_response_body,
+                );
+
+                rows.push(ServiceRow {
+                    server_ip,
+                    server_port,
+                    models,
+                    wire_apis,
+                    request_paths,
+                    call_count: row
+                        .get::<_, u64>(5)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?,
+                    error_count: row
+                        .get::<_, u64>(6)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?,
+                    stream_count: row
+                        .get::<_, u64>(7)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?,
+                    total_input_tokens: row
+                        .get::<_, u64>(8)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?,
+                    total_output_tokens: row
+                        .get::<_, u64>(9)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?,
+                    ttft_avg_ms: row
+                        .get::<_, Option<f64>>(10)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?,
+                    ttft_p95_ms: row
+                        .get::<_, Option<f64>>(11)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?,
+                    e2e_avg_ms: row
+                        .get::<_, Option<f64>>(12)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?,
+                    e2e_p95_ms: row
+                        .get::<_, Option<f64>>(13)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?,
+                    first_seen_ms: row
+                        .get::<_, i64>(14)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?,
+                    last_seen_ms: row
+                        .get::<_, i64>(15)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?,
+                    app,
+                    server_header,
+                });
+            }
+            Ok(rows)
+        })
+        .await
+        .map_err(|e| AppError::Storage(format!("spawn_blocking failed: {e}")))?
+    }
+
+    /// Build the service-topology graph for the Path view. The shape:
+    ///
+    ///   * Nodes — one per `(server_ip, server_port)` seen in the
+    ///     window (reuses the call_count aggregation logic from
+    ///     `query_services`, just the columns we need). Models / app
+    ///     come along so the UI can label and color nodes the same
+    ///     way the Table view does, no second fetch.
+    ///   * Proxy edges — `agent_turns` carries
+    ///     `metadata.proxy.pair_id` from the pair sweeper. For every
+    ///     `proxy_in` turn we look up the sibling `proxy_out` turn(s)
+    ///     by `pair_id`. The `proxy_in.server_endpoint →
+    ///     proxy_out.server_endpoint` pair becomes one edge, counted
+    ///     by number of paired turns. `agent_turns` has no
+    ///     `server_port`, so we look it up via the turn's first
+    ///     `call_ids` entry against `llm_calls`.
+    ///   * Client edges — any service that has a non-`proxy_out` turn
+    ///     in the window gets a virtual edge from `__clients__`. So
+    ///     entry-point services (no inbound proxy hop) still appear
+    ///     connected. We don't break out individual client IPs as
+    ///     nodes — there can be hundreds of SDK instances and the
+    ///     value-add over "they came from outside the service mesh"
+    ///     is low.
+    pub(crate) async fn query_services_topology(
+        &self,
+        query: &ServicesTopologyQuery,
+    ) -> Result<ServicesTopology> {
+        let conn = self.read_pool.acquire().await?;
+        let query = query.clone();
+
+        tokio::task::spawn_blocking(move || {
+            let start_ts = us_to_timestamp(query.time_range.start_us);
+            let end_ts = us_to_timestamp(query.time_range.end_us);
+
+            // Body / header sampling for app classification — same
+            // clipped-window helper used by query_services.
+            let samples = DuckDbBackend::fetch_app_samples(
+                &conn,
+                query.time_range.start_us,
+                query.time_range.end_us,
+            )?;
+
+            let nodes_sql = "SELECT
+                    server_ip,
+                    server_port,
+                    CAST(list_distinct(array_agg(model))[1:32] AS JSON)::VARCHAR    AS models_json,
+                    CAST(list_distinct(array_agg(request_path))[1:16] AS JSON)::VARCHAR AS paths_json,
+                    COUNT(*)                                  AS call_count
+                 FROM llm_calls
+                 WHERE request_time >= ? AND request_time < ?
+                 GROUP BY server_ip, server_port";
+
+            let mut nodes: Vec<TopologyNode> = Vec::new();
+            {
+                let mut stmt = conn.prepare(nodes_sql).map_err(|e| {
+                    AppError::Storage(format!("failed to prepare topology nodes query: {e}"))
+                })?;
+                let mut rs = stmt
+                    .query(duckdb::params![start_ts.clone(), end_ts.clone()])
+                    .map_err(|e| {
+                        AppError::Storage(format!("failed to execute topology nodes query: {e}"))
+                    })?;
+                while let Some(row) = rs
+                    .next()
+                    .map_err(|e| AppError::Storage(format!("row error: {e}")))?
+                {
+                    let server_ip: String = row
+                        .get(0)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+                    let server_port: u16 = row
+                        .get(1)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+                    let models_json: Option<String> = row
+                        .get(2)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+                    let paths_json: Option<String> = row
+                        .get(3)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+                    let call_count: u64 = row
+                        .get(4)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+
+                    let models = parse_json_string_list(models_json.as_deref());
+                    let mut request_paths = parse_json_string_list(paths_json.as_deref());
+
+                    let sample = samples.get(&(server_ip.clone(), server_port));
+                    let finish_reasons = sample.map(|s| s.finish_reasons.clone()).unwrap_or_default();
+                    if let Some(s) = sample {
+                        if !s.request_paths.is_empty() {
+                            request_paths = s.request_paths.clone();
+                        }
+                    }
+                    let sample_response_headers = sample.and_then(|s| s.sample_response_headers.as_deref());
+                    let sample_request_headers = sample.and_then(|s| s.sample_request_headers.as_deref());
+                    let sample_request_body = sample.and_then(|s| s.sample_request_body.as_deref());
+                    let sample_response_body = sample.and_then(|s| s.sample_response_body.as_deref());
+                    let server_header = crate::apps::extract_server_header(sample_response_headers);
+                    let app = crate::apps::classify_app(
+                        server_header.as_deref(),
+                        sample_response_headers,
+                        sample_request_headers,
+                        &request_paths,
+                        &finish_reasons,
+                        &models,
+                        sample_request_body,
+                        sample_response_body,
+                    );
+
+                    nodes.push(TopologyNode {
+                        server_ip,
+                        server_port,
+                        app,
+                        models,
+                        call_count,
+                    });
+                }
+            }
+
+            // --- Proxy edges: pair the turn's endpoint with its
+            // sibling's. We resolve (server_ip, server_port) for each
+            // turn via its first call_id; `agent_turns.server_ip`
+            // alone isn't enough since the table doesn't carry
+            // server_port. Filtering by `proxy.role` is done after
+            // the join because some turns have NULL metadata.
+            //
+            // We keep edges where from != to — same-endpoint pair_id
+            // groups come from multi-interface dup capture (e.g. lo
+            // + docker0 see the same packet), not real proxy hops,
+            // and rendering them adds noise.
+            let edges_sql = "
+                WITH turn_endpoint AS (
+                    SELECT
+                        t.turn_id,
+                        c.server_ip,
+                        c.server_port,
+                        json_extract_string(t.metadata, '$.proxy.role')    AS proxy_role,
+                        json_extract_string(t.metadata, '$.proxy.pair_id') AS pair_id
+                    FROM agent_turns t
+                    JOIN llm_calls c
+                      ON c.id = json_extract_string(t.call_ids, '$[0]')
+                    WHERE t.start_time >= ? AND t.start_time < ?
+                )
+                SELECT
+                    a.server_ip   AS from_ip,
+                    a.server_port AS from_port,
+                    b.server_ip   AS to_ip,
+                    b.server_port AS to_port,
+                    COUNT(*)      AS turn_count
+                FROM turn_endpoint a
+                JOIN turn_endpoint b ON a.pair_id = b.pair_id AND a.turn_id <> b.turn_id
+                WHERE a.proxy_role = 'proxy_in'
+                  AND b.proxy_role = 'proxy_out'
+                  AND a.pair_id IS NOT NULL
+                  AND NOT (a.server_ip = b.server_ip AND a.server_port = b.server_port)
+                GROUP BY a.server_ip, a.server_port, b.server_ip, b.server_port";
+
+            let mut proxy_edges: Vec<TopologyEdge> = Vec::new();
+            {
+                let mut stmt = conn.prepare(edges_sql).map_err(|e| {
+                    AppError::Storage(format!("failed to prepare topology edges query: {e}"))
+                })?;
+                let mut rs = stmt
+                    .query(duckdb::params![start_ts.clone(), end_ts.clone()])
+                    .map_err(|e| {
+                        AppError::Storage(format!("failed to execute topology edges query: {e}"))
+                    })?;
+                while let Some(row) = rs
+                    .next()
+                    .map_err(|e| AppError::Storage(format!("row error: {e}")))?
+                {
+                    let from_ip: String = row
+                        .get(0)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+                    let from_port: u16 = row
+                        .get(1)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+                    let to_ip: String = row
+                        .get(2)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+                    let to_port: u16 = row
+                        .get(3)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+                    let turn_count: u64 = row
+                        .get(4)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+                    proxy_edges.push(TopologyEdge {
+                        from_ip,
+                        from_port,
+                        to_ip,
+                        to_port,
+                        turn_count,
+                        kind: "proxy".to_string(),
+                    });
+                }
+            }
+
+            // --- Inbound traffic grouped by (caller_ip, to_ip,
+            // to_port). For each row we either:
+            //   (a) attribute the traffic to a service we already
+            //       know about — `caller_ip` matches the server_ip of
+            //       some node (typical case: LiteLLM at .81:4210
+            //       accepts an inbound, then makes outgoing calls
+            //       that hit the upstream as `client_ip=172.16.103.81`
+            //       — those should render as litellm → upstream, not
+            //       anonymous-clients → upstream); or
+            //   (b) fall through to a synthetic `__clients__` edge.
+            // Same SQL as before, just adds `client_ip` to the
+            // grouping. We exclude `proxy_out` turns because their
+            // inbound side is the proxy hop itself (already covered
+            // by the pair_sweeper edges above).
+            let entry_sql = "
+                WITH turn_endpoint AS (
+                    SELECT
+                        c.client_ip   AS caller_ip,
+                        c.server_ip   AS to_ip,
+                        c.server_port AS to_port,
+                        COALESCE(json_extract_string(t.metadata, '$.proxy.role'), '') AS proxy_role
+                    FROM agent_turns t
+                    JOIN llm_calls c
+                      ON c.id = json_extract_string(t.call_ids, '$[0]')
+                    WHERE t.start_time >= ? AND t.start_time < ?
+                )
+                SELECT caller_ip, to_ip, to_port, COUNT(*) AS turn_count
+                FROM turn_endpoint
+                WHERE proxy_role <> 'proxy_out'
+                GROUP BY caller_ip, to_ip, to_port";
+
+            // Build per-IP service index so we can resolve a
+            // `caller_ip` to its most-likely originating service.
+            // Strategy: among the services on that IP, prefer
+            // `litellm` (the typical fan-out culprit); next prefer
+            // any explicitly-app-tagged service; fall back to
+            // the highest-call-count one. Skip the target itself so
+            // we never draw a self-loop.
+            let mut services_by_ip: std::collections::HashMap<&str, Vec<&TopologyNode>> =
+                std::collections::HashMap::new();
+            for n in &nodes {
+                services_by_ip.entry(n.server_ip.as_str()).or_default().push(n);
+            }
+            // Quick lookup so we can check the target's app class.
+            let app_of: std::collections::HashMap<(String, u16), Option<String>> = nodes
+                .iter()
+                .map(|n| {
+                    (
+                        (n.server_ip.clone(), n.server_port),
+                        n.app.clone(),
+                    )
+                })
+                .collect();
+            let is_proxy_app = |app: Option<&str>| {
+                matches!(app, Some("litellm") | Some("haproxy") | Some("nginx"))
+            };
+            let resolve_caller = |caller_ip: &str,
+                                  to_ip: &str,
+                                  to_port: u16|
+             -> Option<(String, u16)> {
+                // If the TARGET is itself a proxy (litellm/haproxy/
+                // nginx), inbound calls are by definition real
+                // clients, not another local service forwarding. A
+                // co-host vllm is the destination's neighbour, not
+                // its caller — attributing inbound litellm traffic
+                // to vllm produced backwards edges in early dev.
+                let target_app = app_of
+                    .get(&(to_ip.to_string(), to_port))
+                    .and_then(|a| a.as_deref());
+                if is_proxy_app(target_app) {
+                    return None;
+                }
+                let candidates = services_by_ip.get(caller_ip)?;
+                let usable: Vec<&&TopologyNode> = candidates
+                    .iter()
+                    .filter(|n| !(n.server_ip == to_ip && n.server_port == to_port))
+                    .collect();
+                if usable.is_empty() {
+                    return None;
+                }
+                // 1) Prefer litellm.
+                if let Some(n) = usable.iter().find(|n| n.app.as_deref() == Some("litellm")) {
+                    return Some((n.server_ip.clone(), n.server_port));
+                }
+                // 2) Else any proxy-ish app.
+                if let Some(n) = usable.iter().find(|n| is_proxy_app(n.app.as_deref())) {
+                    return Some((n.server_ip.clone(), n.server_port));
+                }
+                // 3) Else most-active service on that IP.
+                let n = usable
+                    .iter()
+                    .max_by_key(|n| n.call_count)
+                    .expect("usable non-empty");
+                Some((n.server_ip.clone(), n.server_port))
+            };
+
+            // To avoid drawing two arrows for the same hop, dedupe
+            // against proxy_pair edges we already produced.
+            let proxy_pair_set: std::collections::HashSet<(String, u16, String, u16)> = proxy_edges
+                .iter()
+                .map(|e| {
+                    (
+                        e.from_ip.clone(),
+                        e.from_port,
+                        e.to_ip.clone(),
+                        e.to_port,
+                    )
+                })
+                .collect();
+
+            let mut client_edges: Vec<TopologyEdge> = Vec::new();
+            let mut inferred_edges: Vec<TopologyEdge> = Vec::new();
+            {
+                let mut stmt = conn.prepare(entry_sql).map_err(|e| {
+                    AppError::Storage(format!("failed to prepare topology entry query: {e}"))
+                })?;
+                let mut rs = stmt
+                    .query(duckdb::params![start_ts, end_ts])
+                    .map_err(|e| {
+                        AppError::Storage(format!("failed to execute topology entry query: {e}"))
+                    })?;
+                while let Some(row) = rs
+                    .next()
+                    .map_err(|e| AppError::Storage(format!("row error: {e}")))?
+                {
+                    let caller_ip: String = row
+                        .get(0)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+                    let to_ip: String = row
+                        .get(1)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+                    let to_port: u16 = row
+                        .get(2)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+                    let turn_count: u64 = row
+                        .get(3)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
+
+                    match resolve_caller(&caller_ip, &to_ip, to_port) {
+                        Some((from_ip, from_port)) => {
+                            // Suppress if the pair_sweeper already
+                            // covered this hop — we don't want to
+                            // double-count via a weaker signal.
+                            if proxy_pair_set.contains(&(
+                                from_ip.clone(),
+                                from_port,
+                                to_ip.clone(),
+                                to_port,
+                            )) {
+                                continue;
+                            }
+                            inferred_edges.push(TopologyEdge {
+                                from_ip,
+                                from_port,
+                                to_ip,
+                                to_port,
+                                turn_count,
+                                kind: "inferred".to_string(),
+                            });
+                        }
+                        None => {
+                            client_edges.push(TopologyEdge {
+                                from_ip: "__clients__".to_string(),
+                                from_port: 0,
+                                to_ip,
+                                to_port,
+                                turn_count,
+                                kind: "client".to_string(),
+                            });
+                        }
+                    }
+                }
+            }
+
+            // SQL groups by caller_ip but multiple caller_ips can
+            // resolve to the same originating service (e.g. external
+            // 172.16.103.81 AND loopback 127.0.0.1 both have a
+            // litellm); collapse those into single edges.
+            let mut inferred_dedup: std::collections::HashMap<(String, u16, String, u16), u64> =
+                std::collections::HashMap::new();
+            for e in inferred_edges {
+                *inferred_dedup
+                    .entry((e.from_ip, e.from_port, e.to_ip, e.to_port))
+                    .or_insert(0) += e.turn_count;
+            }
+            let inferred_edges: Vec<TopologyEdge> = inferred_dedup
+                .into_iter()
+                .map(|((fi, fp, ti, tp), c)| TopologyEdge {
+                    from_ip: fi,
+                    from_port: fp,
+                    to_ip: ti,
+                    to_port: tp,
+                    turn_count: c,
+                    kind: "inferred".to_string(),
+                })
+                .collect();
+
+            // Same idea for client edges — multiple caller_ips that
+            // don't resolve to a known service still aggregate into
+            // one __clients__ edge per (to_ip, to_port).
+            let mut client_dedup: std::collections::HashMap<(String, u16), u64> =
+                std::collections::HashMap::new();
+            for e in client_edges {
+                *client_dedup.entry((e.to_ip, e.to_port)).or_insert(0) += e.turn_count;
+            }
+            let client_edges: Vec<TopologyEdge> = client_dedup
+                .into_iter()
+                .map(|((ti, tp), c)| TopologyEdge {
+                    from_ip: "__clients__".to_string(),
+                    from_port: 0,
+                    to_ip: ti,
+                    to_port: tp,
+                    turn_count: c,
+                    kind: "client".to_string(),
+                })
+                .collect();
+
+            let mut edges = proxy_edges;
+            edges.extend(inferred_edges);
+            edges.extend(client_edges);
+
+            // Add the synthetic clients node so the UI doesn't have
+            // to invent it. Total call_count is the sum of every
+            // client edge — the number of inbound turn-endpoints
+            // (matches the dotted-line widths on the Path view).
+            let client_total: u64 = edges
+                .iter()
+                .filter(|e| e.kind == "client")
+                .map(|e| e.turn_count)
+                .sum();
+            if client_total > 0 {
+                nodes.push(TopologyNode {
+                    server_ip: "__clients__".to_string(),
+                    server_port: 0,
+                    app: Some("clients".to_string()),
+                    models: Vec::new(),
+                    call_count: client_total,
+                });
+            }
+
+            Ok(ServicesTopology { nodes, edges })
+        })
+        .await
+        .map_err(|e| AppError::Storage(format!("spawn_blocking failed: {e}")))?
+    }
+
+    /// Aggregate agent_turns by agent_kind over the window — drives
+    /// the Overview distribution horizontal-bar chart.
+    pub(crate) async fn query_agent_summary(
+        &self,
+        query: &AgentSummaryQuery,
+    ) -> Result<Vec<AgentKindSummary>> {
+        let conn = self.read_pool.acquire().await?;
+        let query = query.clone();
+        tokio::task::spawn_blocking(move || {
+            let start_ts = us_to_timestamp(query.time_range.start_us);
+            let end_ts = us_to_timestamp(query.time_range.end_us);
+            let sql = "SELECT
+                    agent_kind,
+                    COUNT(*)                                  AS turn_count,
+                    COALESCE(SUM(total_input_tokens), 0)::UBIGINT  AS total_input_tokens,
+                    COALESCE(SUM(total_output_tokens), 0)::UBIGINT AS total_output_tokens,
+                    AVG(duration_ms)                          AS avg_duration_ms,
+                    epoch_ms(MAX(start_time))                 AS last_seen_ms
+                 FROM agent_turns
+                 WHERE start_time >= ? AND start_time < ?
+                 GROUP BY agent_kind
+                 ORDER BY turn_count DESC";
+            let mut stmt = conn.prepare(sql).map_err(|e| {
+                AppError::Storage(format!("failed to prepare agent_summary query: {e}"))
+            })?;
+            let mut rs = stmt
+                .query(duckdb::params![start_ts, end_ts])
+                .map_err(|e| {
+                    AppError::Storage(format!("failed to execute agent_summary query: {e}"))
+                })?;
+            let mut out = Vec::new();
+            while let Some(row) = rs
+                .next()
+                .map_err(|e| AppError::Storage(format!("row error: {e}")))?
+            {
+                out.push(AgentKindSummary {
+                    agent_kind: row
+                        .get(0)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?,
+                    turn_count: row
+                        .get::<_, u64>(1)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?,
+                    total_input_tokens: row
+                        .get::<_, u64>(2)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?,
+                    total_output_tokens: row
+                        .get::<_, u64>(3)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?,
+                    avg_duration_ms: row
+                        .get::<_, Option<f64>>(4)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?,
+                    last_seen_ms: row
+                        .get::<_, i64>(5)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?,
+                });
+            }
+            Ok(out)
+        })
+        .await
+        .map_err(|e| AppError::Storage(format!("spawn_blocking failed: {e}")))?
+    }
+
+    /// Per-bucket counts split by agent_kind. Bucket size auto-picks
+    /// off the window when the client doesn't specify — keeps the
+    /// chart legible from 1 h (1-min buckets) to 30 d (4-h buckets).
+    pub(crate) async fn query_agent_activity(
+        &self,
+        query: &AgentActivityQuery,
+    ) -> Result<Vec<AgentActivityPoint>> {
+        let conn = self.read_pool.acquire().await?;
+        let query = query.clone();
+        tokio::task::spawn_blocking(move || {
+            let start_ts = us_to_timestamp(query.time_range.start_us);
+            let end_ts = us_to_timestamp(query.time_range.end_us);
+            // Target ~60-180 buckets — enough resolution for trends
+            // without making the chart noisy. The client's explicit
+            // hint wins if provided.
+            let window_secs =
+                ((query.time_range.end_us - query.time_range.start_us) / 1_000_000).max(60);
+            let bucket = query.bucket_seconds.unwrap_or_else(|| {
+                let target = (window_secs / 120).max(60) as u32;
+                // Snap to "nice" buckets to keep tick labels readable.
+                for &nice in &[60u32, 300, 600, 1800, 3600, 7200, 14400, 86400] {
+                    if target <= nice {
+                        return nice;
+                    }
+                }
+                86400
+            });
+            let sql = format!(
+                "SELECT
+                    epoch_ms(time_bucket(INTERVAL {bucket} SECOND, start_time)) AS ts,
+                    agent_kind,
+                    COUNT(*) AS turn_count
+                 FROM agent_turns
+                 WHERE start_time >= ? AND start_time < ?
+                 GROUP BY ts, agent_kind
+                 ORDER BY ts ASC, agent_kind ASC"
+            );
+            let mut stmt = conn.prepare(&sql).map_err(|e| {
+                AppError::Storage(format!("failed to prepare agent_activity query: {e}"))
+            })?;
+            let mut rs = stmt
+                .query(duckdb::params![start_ts, end_ts])
+                .map_err(|e| {
+                    AppError::Storage(format!("failed to execute agent_activity query: {e}"))
+                })?;
+            let mut out = Vec::new();
+            while let Some(row) = rs
+                .next()
+                .map_err(|e| AppError::Storage(format!("row error: {e}")))?
+            {
+                out.push(AgentActivityPoint {
+                    timestamp_ms: row
+                        .get(0)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?,
+                    agent_kind: row
+                        .get(1)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?,
+                    turn_count: row
+                        .get::<_, u64>(2)
+                        .map_err(|e| AppError::Storage(format!("read error: {e}")))?,
+                });
+            }
+            Ok(out)
+        })
+        .await
+        .map_err(|e| AppError::Storage(format!("spawn_blocking failed: {e}")))?
+    }
 }
 
 #[cfg(test)]
diff --git a/server/ts-storage-duckdb/src/turns.rs b/server/ts-storage-duckdb/src/turns.rs
index 8057ba6b..b9067711 100644
--- a/server/ts-storage-duckdb/src/turns.rs
+++ b/server/ts-storage-duckdb/src/turns.rs
@@ -243,6 +243,24 @@ impl DuckDbBackend {
                     .collect();
                 where_parts.push(format!("client_ip IN ({})", list.join(", ")));
             }
+            if !query.server_ports.is_empty() {
+                // agent_turns has no server_port column, so we resolve it
+                // via the turn's first call_id against llm_calls — same
+                // shortcut the topology query uses. EXISTS is cheaper
+                // than a JOIN here because we never select from the
+                // joined row.
+                let list: Vec<String> = query
+                    .server_ports
+                    .iter()
+                    .map(|p| p.to_string())
+                    .collect();
+                where_parts.push(format!(
+                    "EXISTS (SELECT 1 FROM llm_calls c \
+                       WHERE c.id = json_extract_string(agent_turns.call_ids, '$[0]') \
+                         AND c.server_port IN ({}))",
+                    list.join(", ")
+                ));
+            }
             if !query.filter.server_ips.is_empty() {
                 let list: Vec<String> = query
                     .filter
@@ -800,6 +818,7 @@ mod tests {
             },
             filter: DimensionFilter::default(),
             client_ips: vec![],
+            server_ports: vec![],
             statuses: vec![],
             agent_kinds: vec![],
             sort_by: "start_time".into(),
diff --git a/server/ts-storage/src/backend.rs b/server/ts-storage/src/backend.rs
index e95612db..930a1bb4 100644
--- a/server/ts-storage/src/backend.rs
+++ b/server/ts-storage/src/backend.rs
@@ -51,6 +51,49 @@ pub trait StorageBackend: Send + Sync {
         query: &MetricsModelsQuery,
     ) -> Result<Vec<MetricsModelRow>>;
 
+    /// Aggregate `llm_calls` by `(server_ip, server_port)` to produce
+    /// one row per LLM-serving endpoint. Used by the Services page.
+    ///
+    /// Not served off the pre-aggregated `llm_metrics` table because
+    /// that schema's grouping sets stop at `server_ip` — different
+    /// vLLM instances on the same host (port 8000 / 9000) would
+    /// collapse into one row. Worst-case this scans `llm_calls` rows
+    /// in the time window; the user's typical 7-day window has tens of
+    /// thousands of rows and the query completes in well under a
+    /// second.
+    async fn query_services(&self, query: &ServicesQuery) -> Result<Vec<ServiceRow>>;
+
+    /// Build the service→service directed graph used by the Services
+    /// page's Path view. Pulls the same per-endpoint node set as
+    /// `query_services` (just call counts; perf stats aren't needed for
+    /// a graph view), then adds two edge kinds:
+    ///   * `proxy` — pair_sweeper-confirmed proxy hops between two
+    ///     real endpoints. Definitive (we observed both legs of the
+    ///     same turn group on the wire).
+    ///   * `client` — synthetic edges from a `__clients__` super-node
+    ///     into every service that has at least one non-proxy-out
+    ///     turn in the window (i.e., the service receives traffic
+    ///     directly, not just from another service). Lets us draw a
+    ///     complete graph even when no proxy hop was observed.
+    async fn query_services_topology(
+        &self,
+        query: &ServicesTopologyQuery,
+    ) -> Result<ServicesTopology>;
+
+    /// Aggregate `agent_turns` by `agent_kind` over the given window.
+    /// Powers the Overview "agent distribution" horizontal-bar chart.
+    async fn query_agent_summary(
+        &self,
+        query: &AgentSummaryQuery,
+    ) -> Result<Vec<AgentKindSummary>>;
+
+    /// Per-bucket agent_turn counts split by `agent_kind`. Powers
+    /// the Overview "agent activity" stacked time-series chart.
+    async fn query_agent_activity(
+        &self,
+        query: &AgentActivityQuery,
+    ) -> Result<Vec<AgentActivityPoint>>;
+
     /// Per-bucket finish-reason counts in the requested time range. One series
     /// per distinct raw `finish_reason` observed. The `wire_api`/`model`
     /// filters select a specific dimension; `None` rolls up across all values
diff --git a/server/ts-storage/src/pair_sweeper.rs b/server/ts-storage/src/pair_sweeper.rs
index 53b6799e..936bd06f 100644
--- a/server/ts-storage/src/pair_sweeper.rs
+++ b/server/ts-storage/src/pair_sweeper.rs
@@ -214,6 +214,27 @@ mod tests {
         ) -> Result<Vec<MetricsModelRow>> {
             Ok(vec![])
         }
+        async fn query_services(&self, _: &ServicesQuery) -> Result<Vec<ServiceRow>> {
+            Ok(vec![])
+        }
+        async fn query_services_topology(
+            &self,
+            _: &ServicesTopologyQuery,
+        ) -> Result<ServicesTopology> {
+            Ok(ServicesTopology { nodes: vec![], edges: vec![] })
+        }
+        async fn query_agent_summary(
+            &self,
+            _: &AgentSummaryQuery,
+        ) -> Result<Vec<AgentKindSummary>> {
+            Ok(vec![])
+        }
+        async fn query_agent_activity(
+            &self,
+            _: &AgentActivityQuery,
+        ) -> Result<Vec<AgentActivityPoint>> {
+            Ok(vec![])
+        }
         async fn query_finish_reasons(
             &self,
             _: &FinishReasonsQuery,
diff --git a/server/ts-storage/src/query.rs b/server/ts-storage/src/query.rs
index a230a55d..30b8ace3 100644
--- a/server/ts-storage/src/query.rs
+++ b/server/ts-storage/src/query.rs
@@ -37,6 +37,146 @@ pub struct MetricsModelsQuery {
     pub limit: u32,
 }
 
+#[derive(Debug, Clone)]
+pub struct ServicesQuery {
+    pub time_range: TimeRange,
+    pub sort_by: String,
+    pub sort_order: String,
+    pub limit: u32,
+}
+
+/// One row of the "Services" view: a unique `(server_ip, server_port)`
+/// endpoint with the models it served, error/perf stats, and the time
+/// window where it appeared. Computed directly off `llm_calls` because
+/// the pre-aggregated `llm_metrics` table doesn't carry `server_port`
+/// (its grouping sets stop at `server_ip`).
+#[derive(Debug, Clone, Serialize)]
+pub struct ServiceRow {
+    pub server_ip: String,
+    pub server_port: u16,
+    /// Distinct models seen on this endpoint. Capped at 32 in SQL via
+    /// `list_distinct(... )[:32]` so a misbehaving client that sends
+    /// thousands of made-up model strings doesn't bloat a single row.
+    pub models: Vec<String>,
+    pub wire_apis: Vec<String>,
+    /// Distinct request paths seen at this endpoint. Used by the
+    /// classifier to spot Ollama (`/api/chat`) and llama.cpp
+    /// (`/completion`, `/tokenize`) from their native non-OpenAI
+    /// surface. Capped at 8 in SQL.
+    pub request_paths: Vec<String>,
+    pub call_count: u64,
+    pub error_count: u64,
+    pub stream_count: u64,
+    pub total_input_tokens: u64,
+    pub total_output_tokens: u64,
+    pub ttft_avg_ms: Option<f64>,
+    pub ttft_p95_ms: Option<f64>,
+    pub e2e_avg_ms: Option<f64>,
+    pub e2e_p95_ms: Option<f64>,
+    /// Unix-epoch milliseconds of the first / last call seen in the
+    /// query window. Useful for "is this endpoint still live?".
+    pub first_seen_ms: i64,
+    pub last_seen_ms: i64,
+    /// Best-effort serving-software identification — one of
+    /// `vllm`, `sglang`, `ollama`, `llamacpp`, `litellm`,
+    /// `openai-compat`, `openai`, `anthropic`, or `None` (unknown).
+    /// vLLM / SGLang both run under uvicorn and can't yet be told
+    /// apart from headers alone; both show up as `openai-compat`
+    /// today. See `apps::classify_app`.
+    pub app: Option<String>,
+    /// Raw `Server` HTTP response header — surfaced in the UI as a
+    /// tooltip so the user can override the classifier visually.
+    pub server_header: Option<String>,
+}
+
+/// Query for the Services *topology* — the directed
+/// service→service / clients→service graph used by the Services page's
+/// Path view. Reuses the same window as `ServicesQuery`; node selection
+/// follows the same `(server_ip, server_port)` grouping as the table.
+#[derive(Debug, Clone)]
+pub struct ServicesTopologyQuery {
+    pub time_range: TimeRange,
+}
+
+/// One node in the service topology graph. The synthetic `__clients__`
+/// node uses `server_ip = "__clients__"`, `server_port = 0`, app =
+/// `Some("clients")`, and models empty — the UI uses these sentinels to
+/// render it differently from real endpoints.
+#[derive(Debug, Clone, Serialize)]
+pub struct TopologyNode {
+    pub server_ip: String,
+    pub server_port: u16,
+    pub app: Option<String>,
+    pub models: Vec<String>,
+    pub call_count: u64,
+}
+
+/// One directed edge in the service topology graph.
+///
+/// * `kind = "proxy"` — pairs found by `pair_sweeper`. Definitive: we
+///   observed both sides of the same turn group on the wire.
+/// * `kind = "inferred"` — heuristic edge. The inbound call's
+///   `client_ip` matches the `server_ip` of an existing service node
+///   (typical pattern: LiteLLM accepts the user's call, then makes
+///   outgoing calls that hit upstream as `client_ip=<litellm host>`).
+///   We attribute the hop to the litellm/proxy service on that host
+///   when there is one, else the most-active service. Less certain
+///   than `proxy` — source ports are ephemeral so we can't pinpoint
+///   when multiple services share a host.
+/// * `kind = "client"` — synthetic edges from the `__clients__`
+///   super-node into entry-point services whose inbound `client_ip`
+///   doesn't resolve to any known service.
+#[derive(Debug, Clone, Serialize)]
+pub struct TopologyEdge {
+    pub from_ip: String,
+    pub from_port: u16,
+    pub to_ip: String,
+    pub to_port: u16,
+    pub turn_count: u64,
+    pub kind: String,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct ServicesTopology {
+    pub nodes: Vec<TopologyNode>,
+    pub edges: Vec<TopologyEdge>,
+}
+
+/// Per-agent-kind aggregate over a time window, used by the Overview
+/// distribution chart.
+#[derive(Debug, Clone)]
+pub struct AgentSummaryQuery {
+    pub time_range: TimeRange,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct AgentKindSummary {
+    pub agent_kind: String,
+    pub turn_count: u64,
+    pub total_input_tokens: u64,
+    pub total_output_tokens: u64,
+    pub avg_duration_ms: Option<f64>,
+    /// Unix-epoch ms of the most recent turn for this agent.
+    pub last_seen_ms: i64,
+}
+
+/// Per-bucket agent_kind counts, used by the Overview activity chart.
+/// `bucket_seconds` is an optional client hint; the server picks a
+/// sensible default based on the window size when omitted.
+#[derive(Debug, Clone)]
+pub struct AgentActivityQuery {
+    pub time_range: TimeRange,
+    pub bucket_seconds: Option<u32>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct AgentActivityPoint {
+    /// Unix-epoch ms of the bucket start.
+    pub timestamp_ms: i64,
+    pub agent_kind: String,
+    pub turn_count: u64,
+}
+
 #[derive(Debug, Clone)]
 pub struct CallsQuery {
     pub time_range: TimeRange,
@@ -44,6 +184,10 @@ pub struct CallsQuery {
     pub status_codes: Vec<u16>,
     pub finish_reasons: Vec<String>,
     pub client_ips: Vec<String>,
+    /// Per-call server port filter (matches `llm_calls.server_port` directly).
+    /// Lives outside `DimensionFilter` for the same reason `client_ips` does:
+    /// `llm_metrics` doesn't carry server_port, only `llm_calls` does.
+    pub server_ports: Vec<u16>,
     pub request_path_contains: Option<String>,
     /// Optional stream-mode filter. `None` keeps everything; `Some(true)` /
     /// `Some(false)` narrows to streaming-only / non-streaming-only.
@@ -213,6 +357,10 @@ pub struct TurnsQuery {
     /// (the metrics-pre-aggregated dimension); client IP lives outside the
     /// filter, parallel to `CallsQuery.client_ips`.
     pub client_ips: Vec<String>,
+    /// Per-call server port filter. `agent_turns` doesn't carry `server_port`
+    /// — we resolve it through the turn's first `call_ids` entry against
+    /// `llm_calls`, same shortcut the topology query uses.
+    pub server_ports: Vec<u16>,
     pub statuses: Vec<String>,
     pub agent_kinds: Vec<String>,
     pub sort_by: String,
diff --git a/server/ts-storage/src/sink.rs b/server/ts-storage/src/sink.rs
index 1270c2d7..81b187bf 100644
--- a/server/ts-storage/src/sink.rs
+++ b/server/ts-storage/src/sink.rs
@@ -211,12 +211,13 @@ pub fn spawn_storage_sink_stage(
 mod tests {
     use super::*;
     use crate::query::{
-        CallDetail, CallsPage, CallsQuery, DistinctFinishReason, FinishReasonTimeseries,
-        FinishReasonsQuery, HttpExchangeDetail, HttpExchangesPage, HttpExchangesQuery,
-        MetricsModelRow, MetricsModelsQuery, MetricsSummaryQuery, MetricsSummaryRow,
-        MetricsTimeseriesQuery, MetricsTimeseriesRow, SessionDetail, SessionListQuery,
-        SessionTurnsPage, SessionTurnsQuery, SessionsPage, TurnCallItem, TurnDetail, TurnsPage,
-        TurnsQuery,
+        AgentActivityPoint, AgentActivityQuery, AgentKindSummary, AgentSummaryQuery, CallDetail,
+        CallsPage, CallsQuery, DistinctFinishReason, FinishReasonTimeseries, FinishReasonsQuery,
+        HttpExchangeDetail, HttpExchangesPage, HttpExchangesQuery, MetricsModelRow,
+        MetricsModelsQuery, MetricsSummaryQuery, MetricsSummaryRow, MetricsTimeseriesQuery,
+        MetricsTimeseriesRow, ServiceRow, ServicesQuery, ServicesTopology, ServicesTopologyQuery,
+        SessionDetail, SessionListQuery, SessionTurnsPage, SessionTurnsQuery, SessionsPage,
+        TurnCallItem, TurnDetail, TurnsPage, TurnsQuery,
     };
     use async_trait::async_trait;
     use std::sync::atomic::{AtomicUsize, Ordering};
@@ -299,6 +300,27 @@ mod tests {
         ) -> Result<Vec<MetricsModelRow>> {
             Ok(vec![])
         }
+        async fn query_services(&self, _query: &ServicesQuery) -> Result<Vec<ServiceRow>> {
+            Ok(vec![])
+        }
+        async fn query_services_topology(
+            &self,
+            _query: &ServicesTopologyQuery,
+        ) -> Result<ServicesTopology> {
+            Ok(ServicesTopology { nodes: vec![], edges: vec![] })
+        }
+        async fn query_agent_summary(
+            &self,
+            _query: &AgentSummaryQuery,
+        ) -> Result<Vec<AgentKindSummary>> {
+            Ok(vec![])
+        }
+        async fn query_agent_activity(
+            &self,
+            _query: &AgentActivityQuery,
+        ) -> Result<Vec<AgentActivityPoint>> {
+            Ok(vec![])
+        }
         async fn query_finish_reasons(
             &self,
             _query: &FinishReasonsQuery,