diff --git a/console/src/components/turn-detail/call-card.tsx b/console/src/components/turn-detail/call-card.tsx
index 69027d0..4e7d00b 100644
--- a/console/src/components/turn-detail/call-card.tsx
+++ b/console/src/components/turn-detail/call-card.tsx
@@ -1,5 +1,5 @@
 import { useState } from "react"
-import { ChevronRight, ChevronDown, Loader2 } from "lucide-react"
+import { ChevronRight, ChevronDown, Layers, Loader2 } from "lucide-react"
 import { cn } from "@/lib/utils"
 import { formatMs, formatNumber } from "@/lib/format"
 import { Markdown } from "@/components/ui/markdown"
@@ -29,6 +29,11 @@ interface Props {
   active?: boolean
   defaultExpanded?: boolean
   onOpenDetail?: (id: string) => void
+  /** When this call is the canonical leg of a folded proxy duplicate
+   * pair (e.g. one captured copy of a LiteLLM→upstream hop is hidden
+   * under it), >0 number of hops folded into this row. Renders a
+   * small "+N hop" chip in the header so the fold is discoverable. */
+  hopCount?: number
 }
 
 export function CallCard({
@@ -39,6 +44,7 @@ export function CallCard({
   active,
   defaultExpanded,
   onOpenDetail,
+  hopCount = 0,
 }: Props) {
   const [expanded, setExpanded] = useState(Boolean(defaultExpanded))
   const speed = classify(call)
@@ -87,6 +93,15 @@ export function CallCard({
             finalCallId={turn.final_call_id}
           />
           <span className="flex-1 truncate text-xs text-muted-foreground">{call.model}</span>
+          {hopCount > 0 && (
+            <span
+              className="inline-flex shrink-0 items-center gap-0.5 rounded bg-blue-500/10 px-1.5 py-0.5 text-[10px] font-medium text-blue-600 dark:text-blue-300"
+              title={`${hopCount} proxy hop call(s) folded under this leg — toggle "Show proxy hops" to reveal`}
+            >
+              <Layers className="size-3" />
+              +{hopCount}
+            </span>
+          )}
           <span className={cn(
             "shrink-0 text-xs tabular-nums",
             (speed === "slow" || speed === "warn") && "text-amber-600",
diff --git a/console/src/components/turn-detail/gantt-nav.tsx b/console/src/components/turn-detail/gantt-nav.tsx
index 4fb835e..0097828 100644
--- a/console/src/components/turn-detail/gantt-nav.tsx
+++ b/console/src/components/turn-detail/gantt-nav.tsx
@@ -1,9 +1,11 @@
 import { useMemo } from "react"
+import { ArrowLeftRight, Copy, Layers } from "lucide-react"
 import { cn } from "@/lib/utils"
 import { formatDuration, formatMs } from "@/lib/format"
 import { classifyType } from "@/lib/wire-apis/dispatch"
 import { GanttCallTypeIcon } from "@/components/call-renderers/chips/dispatch"
 import { finishTone } from "@/lib/finish-tone"
+import { readProxyMeta, proxyGroupSize } from "@/lib/proxy-meta"
 import type { AgentTurnCallItem, AgentTurnDetail } from "@/types/api"
 
 interface Props {
@@ -11,6 +13,11 @@ interface Props {
   calls: AgentTurnCallItem[]
   activeSequence: number | null
   onSelect: (sequence: number) => void
+  /** When the parent panel folds call-level proxy duplicates, this map
+   * tells GanttNav which canonical call ids carry hidden hops so it
+   * can stack a small "+N" indicator on those bars. Empty map (default)
+   * keeps the timeline a flat per-call view. */
+  hopsByCanonical?: Map<string, AgentTurnCallItem[]>
 }
 
 const SLOW_THRESHOLD_MS = 10_000
@@ -25,7 +32,53 @@ function classifySpeed(call: AgentTurnCallItem): "normal" | "slow" | "warn" | "e
 }
 
 
-export function GanttNav({ turn, calls, activeSequence, onSelect }: Props) {
+/**
+ * Compact badge surfaced under the Timeline header when the turn is one
+ * leg of a proxy group. Tells the user "this turn is folded together
+ * with N other captured legs — see the Proxy view tab for the merged
+ * view". Color follows the role-tone palette used by `ProxyBadge` in
+ * the agent-turns list so the two callsites are visually consistent.
+ */
+function MultiLegBadge({
+  proxy,
+  groupSize,
+}: {
+  proxy: ReturnType<typeof readProxyMeta>
+  groupSize: number
+}) {
+  if (!proxy) return null
+  const role = proxy.role
+  const isPrimary = role === "proxy_in" || role === "mirror_primary"
+  const Icon = isPrimary ? ArrowLeftRight : Copy
+  const label =
+    role === "proxy_in"
+      ? "via proxy"
+      : role === "proxy_out"
+        ? "proxy hop"
+        : role === "mirror_primary"
+          ? "mirrored"
+          : "mirror copy"
+  const peers = proxy.peer_turn_ids ?? (proxy.peer_turn_id ? [proxy.peer_turn_id] : [])
+  const title = peers.length > 0
+    ? `${label} — group of ${groupSize} captured legs:\n${peers.join("\n")}`
+    : label
+  return (
+    <div
+      title={title}
+      className={cn(
+        "mt-1 inline-flex items-center gap-1 rounded px-1.5 py-0.5 text-[10px] font-medium",
+        isPrimary
+          ? "bg-blue-500/10 text-blue-600 dark:text-blue-300"
+          : "bg-muted text-muted-foreground",
+      )}
+    >
+      <Icon className="size-3" />
+      <span>{groupSize}-leg {label}</span>
+    </div>
+  )
+}
+
+export function GanttNav({ turn, calls, activeSequence, onSelect, hopsByCanonical }: Props) {
   const { minStart, total } = useMemo(() => {
     if (calls.length === 0) return { minStart: turn.start_time, total: turn.duration_ms || 1 }
     const min = Math.min(...calls.map((c) => c.request_time))
@@ -38,11 +91,15 @@ export function GanttNav({ turn, calls, activeSequence, onSelect }: Props) {
     [calls, turn.final_call_id],
   )
 
+  const proxy = readProxyMeta(turn.metadata)
+  const groupSize = proxyGroupSize(proxy)
+
   return (
     <aside className="flex w-[140px] shrink-0 flex-col border-r border-border">
       <div className="shrink-0 border-b border-border px-3 py-2">
         <div className="text-xs font-medium">Timeline</div>
         <div className="text-[11px] tabular-nums text-muted-foreground">{formatDuration(turn.duration_ms)}</div>
+        {proxy && groupSize >= 2 && <MultiLegBadge proxy={proxy} groupSize={groupSize} />}
       </div>
       <div className="flex-1 overflow-y-auto p-1">
         {calls.length === 0 ? (
@@ -53,15 +110,20 @@ export function GanttNav({ turn, calls, activeSequence, onSelect }: Props) {
             const offset = ((c.request_time - minStart) / total) * 100
             const width = Math.max(((end - c.request_time) / total) * 100, 0.5)
             const speed = classifySpeed(c)
+            const hops = hopsByCanonical?.get(c.id) ?? []
             return (
               <button
                 key={c.id}
                 onClick={() => onSelect(c.sequence)}
+                title={hops.length > 0
+                  ? `Folded ${hops.length} proxy-duplicate leg(s) under this call`
+                  : undefined}
                 className={cn(
                   "grid w-full grid-cols-[16px_16px_1fr_36px] items-center gap-1 rounded px-1 py-1 text-left text-[10px]",
                   activeSequence === c.sequence ? "bg-blue-50 dark:bg-blue-950/40" : "hover:bg-muted/60",
                   (speed === "slow" || speed === "warn") && "border-l-2 border-amber-500/70",
                   speed === "error" && "border-l-2 border-red-500/70",
+                  hops.length > 0 && speed === "normal" && "border-l-2 border-blue-500/70",
                 )}
               >
                 <span className="tabular-nums text-muted-foreground">{c.sequence}</span>
@@ -76,6 +138,17 @@ export function GanttNav({ turn, calls, activeSequence, onSelect }: Props) {
                     )}
                     style={{ left: `${offset}%`, width: `${width}%`, minWidth: "2px" }}
                   />
+                  {/* Folded-hop overlay: a thin underline-style bar
+                      directly below the main bar, indicating one or
+                      more captured peers were folded into this leg.
+                      Width matches the main bar so the eye reads it
+                      as a "shadow" of the same call. */}
+                  {hops.length > 0 && (
+                    <div
+                      className="absolute -bottom-1 h-0.5 rounded bg-blue-500/60"
+                      style={{ left: `${offset}%`, width: `${width}%`, minWidth: "2px" }}
+                    />
+                  )}
                 </div>
                 <span className={cn(
                   "text-right tabular-nums",
@@ -83,6 +156,11 @@ export function GanttNav({ turn, calls, activeSequence, onSelect }: Props) {
                   speed === "error" && "text-red-600",
                   speed === "normal" && "text-muted-foreground",
                 )}>
+                  {hops.length > 0 && (
+                    <span className="mr-1 inline-flex items-center text-blue-500" title={`+${hops.length} folded hop(s)`}>
+                      <Layers className="size-2.5" />
+                    </span>
+                  )}
                   {formatMs(c.e2e_latency_ms)}
                 </span>
               </button>
diff --git a/console/src/components/turn-detail/in-turn-proxy-view.tsx b/console/src/components/turn-detail/in-turn-proxy-view.tsx
new file mode 100644
index 0000000..a3bd81d
--- /dev/null
+++ b/console/src/components/turn-detail/in-turn-proxy-view.tsx
@@ -0,0 +1,147 @@
+/**
+ * In-turn Proxy View — used when call-level duplicates are folded
+ * client-side but the *turn* itself is not part of a backend proxy
+ * group. Common scenario: LiteLLM is captured on the same host and
+ * every LLM call is recorded twice (once on the client-facing port,
+ * once on the upstream-facing port) under one logical agent turn.
+ *
+ * Renders one card per folded pair group:
+ *   - the canonical leg's 5-tuple + status + latency
+ *   - each hidden hop's 5-tuple + status + latency
+ *   - proxy_overhead_ms = canonical.e2e - hop.e2e (when both known)
+ *   - model rewrite line when the canonical and hop models differ
+ *
+ * The header-diff view (response x-litellm-* etc.) would require
+ * parsing the headers blob client-side and is intentionally left as a
+ * follow-up — the v1 surfaces topology + timing + model, which is what
+ * most users want first.
+ */
+import { ArrowRightLeft, Layers } from "lucide-react"
+import { cn } from "@/lib/utils"
+import { formatMs } from "@/lib/format"
+import type { AgentTurnCallItem } from "@/types/api"
+
+interface Props {
+  hopsByCanonical: Map<string, AgentTurnCallItem[]>
+  /** All visible (canonical) calls in their original order — we look
+   * up each canonical's hops in the map. */
+  canonicals: AgentTurnCallItem[]
+}
+
+export function InTurnProxyView({ hopsByCanonical, canonicals }: Props) {
+  // Only canonical calls that actually have folded hops show up here;
+  // direct calls without proxy duplicates are not part of any pair
+  // group and don't need a card.
+  const groups = canonicals.filter((c) => (hopsByCanonical.get(c.id) ?? []).length > 0)
+  if (groups.length === 0) {
+    return (
+      <div className="px-3 py-4 text-xs text-muted-foreground">
+        No call-level proxy duplicates detected in this turn.
+      </div>
+    )
+  }
+  return (
+    <div className="flex flex-col gap-3 p-3 text-sm">
+      <div className="rounded border border-border bg-muted/30 px-3 py-2 text-xs text-muted-foreground">
+        This turn isn't part of a backend proxy group, but{" "}
+        <span className="font-semibold">{groups.length} of its LLM calls</span>{" "}
+        were captured at two vantage points (client → proxy and proxy →
+        upstream). The cards below pair them up with the matching peer.
+      </div>
+      {groups.map((c) => (
+        <CallPairCard key={c.id} canonical={c} hops={hopsByCanonical.get(c.id) ?? []} />
+      ))}
+    </div>
+  )
+}
+
+function CallPairCard({
+  canonical,
+  hops,
+}: {
+  canonical: AgentTurnCallItem
+  hops: AgentTurnCallItem[]
+}) {
+  return (
+    <section className="rounded border border-border">
+      <header className="flex items-center gap-2 border-b border-border bg-muted/40 px-3 py-2 text-xs">
+        <Layers className="size-3 text-blue-500" />
+        <span className="font-medium">Call #{canonical.sequence}</span>
+        <span className="text-muted-foreground">
+          + {hops.length} folded hop{hops.length > 1 ? "s" : ""}
+        </span>
+      </header>
+      <div className="flex flex-col gap-1.5 px-3 py-2">
+        <CallRow call={canonical} role="canonical" />
+        {hops.map((h) => (
+          <CallRow
+            key={h.id}
+            call={h}
+            role="hop"
+            overheadVs={canonical}
+            modelOf={canonical}
+          />
+        ))}
+      </div>
+    </section>
+  )
+}
+
+function CallRow({
+  call,
+  role,
+  overheadVs,
+  modelOf,
+}: {
+  call: AgentTurnCallItem
+  role: "canonical" | "hop"
+  overheadVs?: AgentTurnCallItem
+  modelOf?: AgentTurnCallItem
+}) {
+  const overhead =
+    overheadVs?.e2e_latency_ms != null && call.e2e_latency_ms != null
+      ? overheadVs.e2e_latency_ms - call.e2e_latency_ms
+      : null
+  const modelRewrite = modelOf && modelOf.model !== call.model
+  return (
+    <div className="flex items-center gap-3 text-xs">
+      <span
+        className={cn(
+          "shrink-0 rounded px-1.5 py-0.5 text-[10px] font-medium",
+          role === "canonical"
+            ? "bg-blue-500/15 text-blue-700 dark:text-blue-300"
+            : "bg-muted text-muted-foreground",
+        )}
+      >
+        {role === "canonical" ? "Client-facing" : "Proxy hop"}
+      </span>
+      <span className="font-mono">
+        {call.client_ip}:{call.client_port} → {call.server_ip}:{call.server_port}
+      </span>
+      {modelRewrite && (
+        <span
+          className="inline-flex items-center gap-1 rounded bg-amber-500/15 px-1.5 py-0.5 text-[10px] text-amber-700 dark:text-amber-300"
+          title={`Model rewrite: ${modelOf?.model} → ${call.model}`}
+        >
+          <ArrowRightLeft className="size-2.5" />
+          {call.model}
+        </span>
+      )}
+      <span className="ml-auto tabular-nums text-muted-foreground">
+        {formatMs(call.e2e_latency_ms)}
+      </span>
+      {overhead != null && (
+        <span
+          className={cn(
+            "tabular-nums font-mono text-[10px]",
+            overhead > 5 ? "text-amber-600 dark:text-amber-300" : "text-muted-foreground",
+          )}
+          title="Proxy overhead — canonical e2e − hop e2e"
+        >
+          Δ{overhead >= 0 ? "+" : ""}
+          {overhead.toFixed(1)}ms
+        </span>
+      )}
+    </div>
+  )
+}
diff --git a/console/src/components/turn-detail/proxy-view-tab.tsx b/console/src/components/turn-detail/proxy-view-tab.tsx
new file mode 100644
index 0000000..e574c63
--- /dev/null
+++ b/console/src/components/turn-detail/proxy-view-tab.tsx
@@ -0,0 +1,405 @@
+/**
+ * Proxy View — surfaces what a llmproxy mutated across the captured legs
+ * of one logical LLM call. Shown only when the current turn is part of a
+ * proxy group (i.e. `turn.proxy_role` is set).
+ *
+ * Layout, top to bottom:
+ *   1. Group topology — the IPs/ports + role of every leg, in canonical
+ *      order, with latency next to each.
+ *   2. Latency breakdown — client_observed / upstream_observed / proxy
+ *      overhead derived from the role pairing.
+ *   3. Optional Model Rewrite banner when the proxy forwarded under a
+ *      different model name than the client requested.
+ *   4. Response header diff — usually the most interesting (LiteLLM
+ *      injects x-litellm-* on the response back to the client, while
+ *      upstream returns provider IDs like anthropic-request-id only on
+ *      its leg). Common headers collapse to a single row; modified
+ *      headers spread values per leg; per-leg headers show which role
+ *      injected/owns them.
+ *   5. Request header diff — secondary; usually `Host` rewrites are
+ *      what live here.
+ *
+ * The component is intentionally read-only: it doesn't expose links to
+ * jump into hidden legs (the user already chose the canonical leg by
+ * opening this turn). Drilling into a peer is a separate flow — copy
+ * the turn_id out of the badge and navigate manually.
+ */
+import { useMemo } from "react"
+import { Loader2, ArrowRightLeft, ArrowDownToLine, ArrowUpFromLine } from "lucide-react"
+import { cn } from "@/lib/utils"
+import { formatMs } from "@/lib/format"
+import { useAgentTurnProxyView } from "@/hooks/use-agent-turns"
+import { InTurnProxyView } from "./in-turn-proxy-view"
+import type { AgentTurnCallItem, HeaderDiffEntry, ProxyViewMember } from "@/types/api"
+
+interface Props {
+  turnId: string
+  /** Whether the backend marked the turn itself as part of a proxy
+   * group. When false, we skip the /proxy-view fetch and render the
+   * client-side in-turn fallback (per-call pairings). */
+  hasBackendPair: boolean
+  /** Visible (canonical) calls in render order, used for the in-turn
+   * fallback. */
+  canonicalCalls?: AgentTurnCallItem[]
+  /** Map from canonical call id → its folded hops. Empty / undefined
+   * disables the in-turn fallback. */
+  hopsByCanonical?: Map<string, AgentTurnCallItem[]>
+}
+
+export function ProxyViewTab({ turnId, hasBackendPair, canonicalCalls, hopsByCanonical }: Props) {
+  // The hook always runs (React doesn't allow conditional hooks). We
+  // only show its result when the turn actually has a backend pair —
+  // otherwise we render the in-turn fallback built from the client-side
+  // call grouping. The hook itself returns enabled:false when there's
+  // no backend pair, so no wasted /proxy-view fetch.
+  const { data, isLoading, isError, error } = useAgentTurnProxyView(turnId, hasBackendPair)
+
+  if (!hasBackendPair) {
+    return (
+      <InTurnProxyView
+        hopsByCanonical={hopsByCanonical ?? new Map()}
+        canonicals={canonicalCalls ?? []}
+      />
+    )
+  }
+
+  if (isLoading) {
+    return (
+      <div className="flex items-center justify-center py-12 text-muted-foreground">
+        <Loader2 className="size-4 animate-spin" />
+      </div>
+    )
+  }
+  if (isError || !data) {
+    return (
+      <div className="rounded border border-border bg-muted/30 px-3 py-4 text-xs text-muted-foreground">
+        Proxy view unavailable: {error?.message ?? "no group data"}
+      </div>
+    )
+  }
+
+  return (
+    <div className="flex flex-col gap-4 p-3 text-sm">
+      <TopologySection members={data.members} />
+      <LatencySection breakdown={data.latency_breakdown} />
+      {data.model_rewrite && (
+        <ModelRewriteBanner rewrite={data.model_rewrite} />
+      )}
+      <HeaderDiffSection
+        title="Response headers"
+        entries={data.response_header_diff}
+        members={data.members}
+        defaultExpanded
+      />
+      <HeaderDiffSection
+        title="Request headers"
+        entries={data.request_header_diff}
+        members={data.members}
+      />
+    </div>
+  )
+}
+
+// ----- Topology -----
+
+function TopologySection({ members }: { members: ProxyViewMember[] }) {
+  return (
+    <section>
+      <h3 className="mb-2 text-xs font-semibold uppercase tracking-wide text-muted-foreground">
+        Topology
+      </h3>
+      <div className="flex flex-col gap-2">
+        {members.map((m, i) => (
+          <div
+            key={m.turn_id}
+            className="flex items-center gap-3 rounded border border-border bg-muted/30 px-3 py-2 text-xs"
+          >
+            <RoleChip role={m.role} />
+            <span className="font-mono">
+              {m.client_ip}{m.client_port ? `:${m.client_port}` : ""}
+              {" → "}
+              {m.server_ip}{m.server_port ? `:${m.server_port}` : ""}
+            </span>
+            <span className="ml-auto tabular-nums text-muted-foreground">
+              {formatMs(m.e2e_latency_ms)}
+            </span>
+            <span
+              className="cursor-help font-mono text-[10px] text-muted-foreground/70"
+              title={m.turn_id}
+            >
+              {m.turn_id.slice(-12)}
+            </span>
+            {i < members.length - 1 && (
+              <ArrowRightLeft className="ml-1 size-3 text-muted-foreground/60" />
+            )}
+          </div>
+        ))}
+      </div>
+    </section>
+  )
+}
+
+const ROLE_LABEL: Record<string, { label: string; tone: string }> = {
+  proxy_in: { label: "Client-facing", tone: "bg-blue-500/15 text-blue-700 dark:text-blue-300" },
+  proxy_out: { label: "Upstream hop", tone: "bg-amber-500/15 text-amber-700 dark:text-amber-300" },
+  mirror_primary: { label: "Captured (br0)", tone: "bg-emerald-500/15 text-emerald-700 dark:text-emerald-300" },
+  mirror_secondary: { label: "Captured (docker0)", tone: "bg-muted text-muted-foreground" },
+}
+
+function RoleChip({ role }: { role: string }) {
+  const info = ROLE_LABEL[role] ?? { label: role, tone: "bg-muted text-muted-foreground" }
+  return (
+    <span
+      className={cn("rounded px-1.5 py-0.5 text-[10px] font-medium", info.tone)}
+      title={role}
+    >
+      {info.label}
+    </span>
+  )
+}
+
+// ----- Latency breakdown -----
+
+function LatencySection({ breakdown }: { breakdown: { client_observed_ms: number | null; upstream_observed_ms: number | null; proxy_overhead_ms: number | null } }) {
+  if (
+    breakdown.client_observed_ms == null
+    && breakdown.upstream_observed_ms == null
+    && breakdown.proxy_overhead_ms == null
+  ) {
+    return null
+  }
+  return (
+    <section>
+      <h3 className="mb-2 text-xs font-semibold uppercase tracking-wide text-muted-foreground">
+        Latency
+      </h3>
+      <div className="grid grid-cols-3 gap-3">
+        <Stat label="Client observed" value={formatMs(breakdown.client_observed_ms)} />
+        <Stat label="Upstream observed" value={formatMs(breakdown.upstream_observed_ms)} />
+        <Stat
+          label="Proxy overhead"
+          value={formatMs(breakdown.proxy_overhead_ms)}
+          tone={breakdown.proxy_overhead_ms != null && breakdown.proxy_overhead_ms > 100 ? "warn" : undefined}
+        />
+      </div>
+    </section>
+  )
+}
+
+function Stat({ label, value, tone }: { label: string; value: string; tone?: "warn" }) {
+  return (
+    <div className="rounded border border-border bg-muted/30 px-3 py-2">
+      <div className="text-[10px] uppercase tracking-wide text-muted-foreground">{label}</div>
+      <div className={cn("mt-0.5 text-base font-medium tabular-nums", tone === "warn" && "text-amber-600 dark:text-amber-300")}>
+        {value}
+      </div>
+    </div>
+  )
+}
+
+// ----- Model rewrite -----
+
+function ModelRewriteBanner({ rewrite }: { rewrite: { client_requested: string | null; upstream_received: string | null } }) {
+  return (
+    <section className="rounded border border-amber-500/40 bg-amber-500/10 px-3 py-2 text-xs">
+      <div className="flex items-center gap-2 font-semibold">
+        <ArrowRightLeft className="size-3.5" />
+        Model rewrite
+      </div>
+      <div className="mt-1 flex items-center gap-2 font-mono">
+        <code>{rewrite.client_requested ?? "—"}</code>
+        <span className="text-muted-foreground">→</span>
+        <code>{rewrite.upstream_received ?? "—"}</code>
+      </div>
+    </section>
+  )
+}
+
+// ----- Header diff -----
+
+function HeaderDiffSection({
+  title,
+  entries,
+  members,
+  defaultExpanded = false,
+}: {
+  title: string
+  entries: HeaderDiffEntry[]
+  members: ProxyViewMember[]
+  defaultExpanded?: boolean
+}) {
+  const grouped = useMemo(() => {
+    const common = entries.filter((e) => e.kind === "common")
+    const modified = entries.filter((e) => e.kind === "modified")
+    const perLeg = entries.filter((e) => e.kind === "per_leg")
+    return { common, modified, perLeg }
+  }, [entries])
+
+  return (
+    <section>
+      <h3 className="mb-2 text-xs font-semibold uppercase tracking-wide text-muted-foreground">
+        {title}
+        <span className="ml-2 font-mono text-[10px] text-muted-foreground/70">
+          {grouped.modified.length} modified · {grouped.perLeg.length} per-leg · {grouped.common.length} common
+        </span>
+      </h3>
+      {grouped.modified.length > 0 && (
+        <HeaderDiffTable entries={grouped.modified} members={members} kindBadge="modified" />
+      )}
+      {grouped.perLeg.length > 0 && (
+        <HeaderDiffTable entries={grouped.perLeg} members={members} kindBadge="per_leg" />
+      )}
+      {grouped.common.length > 0 && (
+        <details className="mt-1 rounded border border-border bg-muted/20" open={defaultExpanded ? false : false}>
+          <summary className="cursor-pointer select-none px-3 py-1.5 text-xs text-muted-foreground">
+            {grouped.common.length} common header(s)
+          </summary>
+          <HeaderDiffTable entries={grouped.common} members={members} kindBadge="common" />
+        </details>
+      )}
+    </section>
+  )
+}
+
+function HeaderDiffTable({
+  entries,
+  members,
+  kindBadge,
+}: {
+  entries: HeaderDiffEntry[]
+  members: ProxyViewMember[]
+  kindBadge: "common" | "modified" | "per_leg"
+}) {
+  return (
+    <div className="overflow-hidden rounded border border-border">
+      <table className="w-full text-xs">
+        <tbody>
+          {entries.map((e) => (
+            <HeaderRow key={e.name} entry={e} members={members} kindBadge={kindBadge} />
+          ))}
+        </tbody>
+      </table>
+    </div>
+  )
+}
+
+function HeaderRow({
+  entry,
+  members,
+  kindBadge,
+}: {
+  entry: HeaderDiffEntry
+  members: ProxyViewMember[]
+  kindBadge: "common" | "modified" | "per_leg"
+}) {
+  // For "common", just one row with the single shared value.
+  if (kindBadge === "common") {
+    const value = entry.values[0]?.value ?? ""
+    return (
+      <tr className="border-b border-border/50 last:border-b-0">
+        <td className="w-1/3 truncate px-3 py-1.5 font-mono text-muted-foreground" title={entry.name}>
+          {entry.name}
+        </td>
+        <td className="px-3 py-1.5 font-mono text-muted-foreground/70" title={value}>
+          {truncate(value, 120)}
+        </td>
+      </tr>
+    )
+  }
+
+  // For modified / per_leg, expand one sub-row per value to clarify
+  // which leg owns which value.
+  const totalLegs = members.length
+  const presentRoles = new Set(entry.values.map((v) => v.role))
+  const missingMembers = members.filter((m) => !presentRoles.has(m.role) && totalLegs !== entry.values.length)
+  return (
+    <>
+      <tr className="border-b border-border/50">
+        <td
+          className="w-1/3 truncate px-3 py-1.5 font-mono"
+          title={entry.name}
+          rowSpan={entry.values.length + (missingMembers.length > 0 ? 1 : 0)}
+        >
+          <div className="flex items-center gap-1.5">
+            {entry.name}
+            <KindBadge kind={kindBadge} />
+          </div>
+        </td>
+        <td className="px-3 py-1.5">
+          <ValueCell value={entry.values[0]} />
+        </td>
+      </tr>
+      {entry.values.slice(1).map((v, i) => (
+        <tr key={i} className="border-b border-border/50">
+          <td className="px-3 py-1.5">
+            <ValueCell value={v} />
+          </td>
+        </tr>
+      ))}
+      {missingMembers.length > 0 && (
+        <tr className="border-b border-border/50 last:border-b-0">
+          <td className="px-3 py-1.5 text-muted-foreground/60">
+            <span className="font-mono text-[10px]">
+              {missingMembers.map((m) => roleShort(m.role)).join(", ")}: <span className="italic">absent</span>
+            </span>
+          </td>
+        </tr>
+      )}
+    </>
+  )
+}
+
+function ValueCell({ value }: { value: { role: string; value: string; turn_id: string } }) {
+  return (
+    <div className="flex items-baseline gap-2">
+      <span className="shrink-0 font-mono text-[10px] text-muted-foreground" title={value.turn_id}>
+        {roleShort(value.role)}
+      </span>
+      <span className="break-all font-mono" title={value.value}>
+        {truncate(value.value, 180)}
+      </span>
+    </div>
+  )
+}
+
+function KindBadge({ kind }: { kind: "common" | "modified" | "per_leg" }) {
+  if (kind === "common") return null
+  if (kind === "modified") {
+    return (
+      <span className="inline-flex items-center gap-0.5 rounded bg-amber-500/15 px-1 py-0.5 text-[9px] font-medium text-amber-700 dark:text-amber-300">
+        <ArrowRightLeft className="size-2.5" />
+        modified
+      </span>
+    )
+  }
+  return (
+    <span className="inline-flex items-center gap-0.5 rounded bg-blue-500/15 px-1 py-0.5 text-[9px] font-medium text-blue-700 dark:text-blue-300">
+      <ArrowDownToLine className="size-2.5" />
+      per leg
+    </span>
+  )
+}
+
+function roleShort(role: string): string {
+  switch (role) {
+    case "proxy_in":
+      return "in"
+    case "proxy_out":
+      return "out"
+    case "mirror_primary":
+      return "mir1"
+    case "mirror_secondary":
+      return "mir2"
+    default:
+      return role
+  }
+}
+
+function truncate(s: string, max: number): string {
+  if (s.length <= max) return s
+  return s.slice(0, max) + "…"
+}
+
+// Re-exported but not used directly — keeps the lucide import lean while
+// allowing the component to evolve without dropping it.
+export { ArrowUpFromLine }
diff --git a/console/src/components/ui/proxy-badge.tsx b/console/src/components/ui/proxy-badge.tsx
new file mode 100644
index 0000000..93a7b18
--- /dev/null
+++ b/console/src/components/ui/proxy-badge.tsx
@@ -0,0 +1,58 @@
+import { ArrowLeftRight, Copy } from "lucide-react"
+import { cn } from "@/lib/utils"
+import type { AgentTurnListItem } from "@/types/api"
+
+/**
+ * Inline indicator on agent-turn rows that the backend pair sweeper
+ * matched this row with another captured-but-hidden leg.
+ *
+ * * `proxy_in` — outer leg of a real proxy hop (haproxy / litellm). The
+ *   inner upstream leg is folded out of the default list view.
+ * * `mirror_primary` — same packet captured on two interfaces (br0 +
+ *   docker0 typically). The other copy is folded out.
+ *
+ * Hidden roles (`proxy_out` / `mirror_secondary`) never reach this
+ * component when the default `include_proxy_hops=false` is in effect;
+ * we render the badge for them too (with a `(hop)` label) so users who
+ * toggle hops on can see which side they're looking at.
+ */
+export function ProxyBadge({ item }: { item: AgentTurnListItem }) {
+  if (!item.proxy_role) return null
+  const role = item.proxy_role
+  const isPrimary = role === "proxy_in" || role === "mirror_primary"
+  const Icon = isPrimary ? ArrowLeftRight : Copy
+  // Group size = self + every peer. For the haproxy 3-leg case the
+  // canonical row reads "via proxy (+2 hops)"; the 2-leg case stays
+  // "via proxy".
+  const peerCount = item.proxy_peer_turn_ids?.length
+    ?? (item.proxy_peer_turn_id ? 1 : 0)
+  const baseLabel =
+    role === "proxy_in"
+      ? "via proxy"
+      : role === "proxy_out"
+        ? "proxy hop"
+        : role === "mirror_primary"
+          ? "mirrored"
+          : "mirror copy"
+  const label = peerCount > 1 ? `${baseLabel} (+${peerCount} hops)` : baseLabel
+  const peers = item.proxy_peer_turn_ids ?? (item.proxy_peer_turn_id ? [item.proxy_peer_turn_id] : [])
+  const title = peers.length > 0
+    ? `${baseLabel} — peer turn${peers.length > 1 ? "s" : ""}:\n${peers.join("\n")}`
+    : baseLabel
+  return (
+    <span
+      title={title}
+      className={cn(
+        "inline-flex items-center gap-1 rounded px-1.5 py-0.5 text-[10px] font-medium",
+        // Visible-by-default legs get a subtle blue; hidden hops get a
+        // gray "secondary" treatment.
+        isPrimary
+          ? "bg-blue-500/10 text-blue-600 dark:text-blue-300"
+          : "bg-muted text-muted-foreground",
+      )}
+    >
+      <Icon className="size-3" />
+      {label}
+    </span>
+  )
+}
diff --git a/console/src/hooks/use-agent-turns.ts b/console/src/hooks/use-agent-turns.ts
index 78b76f9..db4c925 100644
--- a/console/src/hooks/use-agent-turns.ts
+++ b/console/src/hooks/use-agent-turns.ts
@@ -2,7 +2,7 @@ import { useQuery } from "@tanstack/react-query"
 import { apiFetch } from "@/lib/api"
 import { useToolbarStore } from "@/stores/toolbar"
 import { useSupportedFilterParams } from "@/hooks/use-supported-filters"
-import type { AgentTurnsPage, AgentTurnDetail, AgentTurnCallItem } from "@/types/api"
+import type { AgentTurnsPage, AgentTurnDetail, AgentTurnCallItem, ProxyViewResponse } from "@/types/api"
 
 interface UseAgentTurnsParams {
   page: number
@@ -15,9 +15,12 @@ interface UseAgentTurnsParams {
   agentKind?: string
   /** CSV of client IPs e.g. "10.0.0.1,10.0.0.2" */
   clientIp?: string
+  /** When true, return turns the pair sweeper marked hidden
+   * (`proxy_out` / `mirror_secondary`). Default false. */
+  includeProxyHops?: boolean
 }
 
-export function useAgentTurns({ page, pageSize, sortBy, sortOrder, status, agentKind, clientIp }: UseAgentTurnsParams) {
+export function useAgentTurns({ page, pageSize, sortBy, sortOrder, status, agentKind, clientIp, includeProxyHops }: UseAgentTurnsParams) {
   const start = useToolbarStore((s) => s.start)
   const end = useToolbarStore((s) => s.end)
   const { params: fp } = useSupportedFilterParams()
@@ -26,7 +29,7 @@ export function useAgentTurns({ page, pageSize, sortBy, sortOrder, status, agent
     queryKey: ["agent-turns", {
       start, end, page, pageSize, sortBy, sortOrder,
       ...fp,
-      status, agentKind, clientIp,
+      status, agentKind, clientIp, includeProxyHops,
     }],
     queryFn: () =>
       apiFetch<AgentTurnsPage>("/api/agent-turns", {
@@ -40,6 +43,7 @@ export function useAgentTurns({ page, pageSize, sortBy, sortOrder, status, agent
         status: status || undefined,
         agent_kind: agentKind || undefined,
         client_ip: clientIp || undefined,
+        include_proxy_hops: includeProxyHops ? "true" : undefined,
       }),
     placeholderData: (prev) => prev,
   })
@@ -72,3 +76,15 @@ export function useAgentTurnCalls(id: string | null, lite = false) {
     enabled: id != null,
   })
 }
+
+/** Fetches the multi-leg fold for a turn that's part of a proxy group.
+ * Returns a 404 (and a useQuery error) when the turn is not part of any
+ * group — callers gate on `turn.proxy_role` being set before showing
+ * the proxy-view tab. */
+export function useAgentTurnProxyView(id: string | null, enabled = true) {
+  return useQuery({
+    queryKey: ["agent-turn-proxy-view", id],
+    queryFn: () => apiFetch<ProxyViewResponse>(`/api/agent-turns/${id}/proxy-view`),
+    enabled: id != null && enabled,
+  })
+}
diff --git a/console/src/hooks/use-url-sync.ts b/console/src/hooks/use-url-sync.ts
index 2cabd97..5e949ee 100644
--- a/console/src/hooks/use-url-sync.ts
+++ b/console/src/hooks/use-url-sync.ts
@@ -46,6 +46,15 @@ export function useToolbarUrlSync() {
   const [searchParams, setSearchParams] = useSearchParams()
   const { pathname } = useLocation()
   const skipUrlUpdate = useRef(false)
+  // The selected_at anchor exists to rescue a STALE shared link — when
+  // the recipient opens a URL whose relative preset has moved past the
+  // selected item, shift the window so the item is in view. Applying
+  // it on every searchParams change wrecks the live page: every click
+  // updates ?selected_at=, the URL→store effect re-runs, and the helper
+  // sees the (slightly newer) window boundary as having drifted past
+  // the just-clicked item — shifting unexpectedly. Gate the anchor to
+  // the very first hydration in this tab.
+  const anchorAppliedOnce = useRef(false)
 
   // ── URL → Store (on mount & on searchParams change from popstate) ──
   useEffect(() => {
@@ -69,8 +78,11 @@ export function useToolbarUrlSync() {
       }
     }
 
-    const selectedAtRaw = searchParams.get(SELECTED_AT_PARAM)
-    applySelectedAtAnchor(hydratePatch, selectedAtRaw, nowSeconds())
+    if (!anchorAppliedOnce.current) {
+      const selectedAtRaw = searchParams.get(SELECTED_AT_PARAM)
+      applySelectedAtAnchor(hydratePatch, selectedAtRaw, nowSeconds())
+      anchorAppliedOnce.current = true
+    }
 
     const wireApi = searchParams.get(P.wireApi)
     const model = searchParams.get(P.model)
diff --git a/console/src/lib/call-pair.test.ts b/console/src/lib/call-pair.test.ts
new file mode 100644
index 0000000..b49428f
--- /dev/null
+++ b/console/src/lib/call-pair.test.ts
@@ -0,0 +1,248 @@
+import { describe, expect, it } from "bun:test"
+import { groupCalls } from "./call-pair"
+import type { AgentTurnCallItem } from "@/types/api"
+
+function call(over: Partial<AgentTurnCallItem>): AgentTurnCallItem {
+  return {
+    id: "c",
+    sequence: 1,
+    request_time: 0,
+    response_time: 100,
+    complete_time: 200,
+    wire_api: "openai-chat",
+    model: "GLM-5.1",
+    status_code: 200,
+    is_stream: true,
+    finish_reason: "stop",
+    ttft_ms: 50,
+    e2e_latency_ms: 200,
+    input_tokens: 100,
+    output_tokens: 10,
+    request_path: "/v1/chat/completions",
+    client_ip: "127.0.0.1",
+    client_port: 1000,
+    server_ip: "127.0.0.1",
+    server_port: 4000,
+    request_body: null,
+    response_body: null,
+    request_headers: null,
+    response_headers: null,
+    ...over,
+  }
+}
+
+describe("groupCalls", () => {
+  it("leaves direct calls untouched", () => {
+    const c1 = call({ id: "a", sequence: 1 })
+    const c2 = call({ id: "b", sequence: 2, request_time: 500_000, client_port: 1001 })
+    const g = groupCalls([c1, c2])
+    expect(g.visible).toHaveLength(2)
+    expect(g.hopCount).toBe(0)
+    expect(g.hopsByCanonical.size).toBe(0)
+  })
+
+  it("folds a 2-leg pair (client→litellm + litellm→upstream)", () => {
+    // Mirrors the user's wuneng case: seq 1 → :4000 e2e=1701ms,
+    // seq 2 → :9008 e2e=1645ms, ~50ms apart on request_time.
+    const c1 = call({
+      id: "leg1",
+      sequence: 1,
+      request_time: 1779167694777,
+      response_time: 1779167694800,
+      complete_time: 1779167694777 + 1701,
+      e2e_latency_ms: 1701,
+      client_port: 60590,
+      server_port: 4000,
+    })
+    const c2 = call({
+      id: "leg2",
+      sequence: 2,
+      request_time: 1779167694825,
+      response_time: 1779167694850,
+      complete_time: 1779167694825 + 1645,
+      e2e_latency_ms: 1645,
+      client_port: 58950,
+      server_port: 9008,
+    })
+    const g = groupCalls([c1, c2])
+    expect(g.visible).toHaveLength(1)
+    expect(g.visible[0].id).toBe("leg1") // longer span → canonical
+    expect(g.hopsByCanonical.get("leg1")?.[0].id).toBe("leg2")
+    expect(g.hopCount).toBe(1)
+    expect(g.hopSequences.has(2)).toBe(true)
+  })
+
+  it("folds many sequential pairs in one turn", () => {
+    // 6 calls = 3 logical pairs (the user's case shrunk down).
+    const calls: AgentTurnCallItem[] = []
+    for (let i = 0; i < 3; i++) {
+      const t = i * 2000 // 2s apart pairs
+      calls.push(call({
+        id: `a${i}`,
+        sequence: i * 2 + 1,
+        request_time: t,
+        complete_time: t + 1700,
+        client_port: 60000 + i,
+        server_port: 4000,
+        input_tokens: 100 + i, // each pair distinct content
+      }))
+      calls.push(call({
+        id: `b${i}`,
+        sequence: i * 2 + 2,
+        request_time: t + 50,
+        complete_time: t + 1650,
+        client_port: 58000 + i,
+        server_port: 9008,
+        input_tokens: 100 + i,
+      }))
+    }
+    const g = groupCalls(calls)
+    expect(g.visible).toHaveLength(3)
+    expect(g.hopCount).toBe(3)
+    // Every visible call is a canonical with exactly one hop.
+    for (const v of g.visible) {
+      expect(g.hopsByCanonical.get(v.id)?.length).toBe(1)
+    }
+  })
+
+  it("requires distinct (client_port, server_port) — same view not paired", () => {
+    // Two calls at the same net view fingerprint within 100ms — could
+    // be the same client retrying; do NOT fold.
+    const c1 = call({ id: "a", request_time: 0, client_port: 1000, server_port: 4000 })
+    const c2 = call({ id: "b", request_time: 50, client_port: 1000, server_port: 4000 })
+    const g = groupCalls([c1, c2])
+    expect(g.visible).toHaveLength(2)
+    expect(g.hopCount).toBe(0)
+  })
+
+  it("does not pair when tokens differ", () => {
+    const c1 = call({ id: "a", request_time: 0, client_port: 1000, server_port: 4000, input_tokens: 100 })
+    const c2 = call({ id: "b", request_time: 50, client_port: 2000, server_port: 9008, input_tokens: 101 })
+    const g = groupCalls([c1, c2])
+    expect(g.visible).toHaveLength(2)
+    expect(g.hopCount).toBe(0)
+  })
+
+  it("does not pair across the 100ms time window", () => {
+    const c1 = call({ id: "a", request_time: 0, client_port: 1000, server_port: 4000 })
+    const c2 = call({ id: "b", request_time: 200, client_port: 2000, server_port: 9008 })
+    const g = groupCalls([c1, c2])
+    expect(g.visible).toHaveLength(2)
+    expect(g.hopCount).toBe(0)
+  })
+
+  it("supports 3-leg cluster (haproxy br0 + docker0 + upstream)", () => {
+    const a = call({
+      id: "a", sequence: 1, request_time: 0, complete_time: 2000,
+      client_port: 5000, server_port: 9000,
+    })
+    const b = call({
+      id: "b", sequence: 2, request_time: 0, complete_time: 2000,
+      client_ip: "172.17.0.1", server_ip: "172.17.0.9",
+      client_port: 5001, server_port: 9001,
+    })
+    const c = call({
+      id: "c", sequence: 3, request_time: 2, complete_time: 1998,
+      client_ip: "172.17.0.1", server_ip: "172.17.0.4",
+      client_port: 5002, server_port: 30000,
+    })
+    const g = groupCalls([a, b, c])
+    expect(g.visible).toHaveLength(1)
+    expect(g.hopCount).toBe(2)
+  })
+
+  it("pairs even when request_path differs (proxy URL rewrite)", () => {
+    // Real-world LiteLLM case from wuneng: client SDK sends
+    // /v1/chat/completions to LiteLLM (port 4000), LiteLLM forwards
+    // bare /chat/completions to the upstream (port 9008). Same call,
+    // different captured paths.
+    const c1 = call({
+      id: "client", sequence: 1, request_time: 1779167694777,
+      complete_time: 1779167694777 + 1701, e2e_latency_ms: 1701,
+      client_port: 60590, server_port: 4000,
+      request_path: "/chat/completions",
+    })
+    const c2 = call({
+      id: "upstream", sequence: 2, request_time: 1779167694825,
+      complete_time: 1779167694825 + 1645, e2e_latency_ms: 1645,
+      client_port: 58950, server_port: 9008,
+      request_path: "/v1/chat/completions",
+    })
+    const g = groupCalls([c1, c2])
+    expect(g.visible).toHaveLength(1)
+    expect(g.hopCount).toBe(1)
+  })
+
+  it("pairs even when model differs (LiteLLM alias rewrite)", () => {
+    // Live wuneng case: client SDK sends `glm5` (alias) to LiteLLM:4000,
+    // LiteLLM rewrites it to `GLM-5.1` for the upstream. Same logical
+    // call, different model field per leg. Model rewrite IS surfaced
+    // in the Proxy view; pairing must succeed regardless.
+    const c1 = call({
+      id: "alias", sequence: 1, request_time: 1779171261156,
+      complete_time: 1779171261156 + 3070, e2e_latency_ms: 3070,
+      client_port: 48264, server_port: 4000,
+      model: "glm5",
+    })
+    const c2 = call({
+      id: "rewritten", sequence: 2, request_time: 1779171261213,
+      complete_time: 1779171261213 + 2998, e2e_latency_ms: 2998,
+      client_port: 40326, server_port: 9000,
+      model: "GLM-5.1",
+    })
+    const g = groupCalls([c1, c2])
+    expect(g.visible).toHaveLength(1)
+    expect(g.hopCount).toBe(1)
+  })
+
+  it("folds a 4-leg topology (alias + 3 rewritten legs)", () => {
+    // Exact shape from production: glm5 (LiteLLM ingress) → GLM-5.1
+    // (LiteLLM egress, captured 3x at different views) — all share
+    // identical tokens.
+    const base = 1779171261156
+    const calls: AgentTurnCallItem[] = [
+      call({ id: "a", sequence: 1, request_time: base, complete_time: base + 3070, e2e_latency_ms: 3070, client_port: 48264, server_port: 4000, model: "glm5" }),
+      call({ id: "b", sequence: 2, request_time: base + 57, complete_time: base + 57 + 2998, e2e_latency_ms: 2998, client_port: 40326, server_port: 9000, model: "GLM-5.1" }),
+      call({ id: "c", sequence: 3, request_time: base + 58, complete_time: base + 58 + 2997, e2e_latency_ms: 2997, client_ip: "172.17.0.1", client_port: 53036, server_ip: "172.17.0.9", server_port: 9000, model: "GLM-5.1" }),
+      call({ id: "d", sequence: 4, request_time: base + 60, complete_time: base + 60 + 2994, e2e_latency_ms: 2994, client_ip: "172.17.0.1", client_port: 39476, server_ip: "172.17.0.4", server_port: 30000, model: "GLM-5.1" }),
+    ]
+    const g = groupCalls(calls)
+    expect(g.visible).toHaveLength(1)
+    expect(g.hopCount).toBe(3)
+  })
+
+  it("pairs across API styles (Anthropic ingress → OpenAI upstream)", () => {
+    // LiteLLM accepts Anthropic-style at /v1/messages and forwards
+    // OpenAI-chat-style at /v1/chat/completions. wire_api differs
+    // ("anthropic" vs "openai-chat") AND finish_reason differs
+    // ("end_turn" vs "stop") AND the path differs — only tokens
+    // and status are constant.
+    const c1 = call({
+      id: "anth", sequence: 1, request_time: 0, complete_time: 2000,
+      client_port: 5000, server_port: 4000,
+      wire_api: "anthropic",
+      finish_reason: "end_turn",
+      request_path: "/v1/messages",
+      model: "claude-3-5-sonnet-20241022",
+    })
+    const c2 = call({
+      id: "oai", sequence: 2, request_time: 50, complete_time: 1950,
+      client_port: 5001, server_port: 9008,
+      wire_api: "openai-chat",
+      finish_reason: "stop",
+      request_path: "/v1/chat/completions",
+      model: "GLM-5.1",
+    })
+    const g = groupCalls([c1, c2])
+    expect(g.visible).toHaveLength(1)
+    expect(g.hopCount).toBe(1)
+  })
+
+  it("preserves call order in the visible list", () => {
+    const c1 = call({ id: "first", sequence: 1, request_time: 0, client_port: 1000, server_port: 4000 })
+    const c2 = call({ id: "first-hop", sequence: 2, request_time: 50, client_port: 2000, server_port: 9008 })
+    const c3 = call({ id: "second", sequence: 3, request_time: 5000, client_port: 1000, server_port: 4000, input_tokens: 200 })
+    const g = groupCalls([c1, c2, c3])
+    expect(g.visible.map((v) => v.id)).toEqual(["first", "second"])
+  })
+})
diff --git a/console/src/lib/call-pair.ts b/console/src/lib/call-pair.ts
new file mode 100644
index 0000000..d0df658
--- /dev/null
+++ b/console/src/lib/call-pair.ts
@@ -0,0 +1,185 @@
+/**
+ * Client-side pair detection for LLM calls *within* a single agent turn.
+ *
+ * Mirrors the backend `ts-turn::proxy_pair::group_all` algorithm but
+ * runs on the `/api/agent-turns/{id}/calls` payload. We do this in JS
+ * (not in the backend) because the `llm_calls` table has no metadata
+ * column to persist call-level pairings — adding one would require a
+ * migration. The visual fold solves the user's immediate complaint
+ * (24 captured calls reduced to 12 logical calls in the timeline)
+ * without changing the on-disk schema.
+ *
+ * The trade-off: `agent_turns.call_count` still reports the raw 24
+ * because that aggregate is computed at ingest time. Surfacing a
+ * "logical call count" in the turn header is a follow-up.
+ */
+
+import type { AgentTurnCallItem } from "@/types/api"
+
+/** Maximum gap (ms) between any two calls' request_times for them to
+ * cluster into the same group. Matches the backend's
+ * MAX_REQ_TIME_GAP_US / 1000. Real proxy hops fire within a few ms;
+ * 100ms is generous headroom for slow proxies. */
+const MAX_REQ_TIME_GAP_MS = 100
+
+/** Same-packet vs real-hop separator. Below this delta the legs are
+ * treated as "mirrors" of one another (canonical = lex-smallest id).
+ * Above, the wider-span leg is the proxy_in client-facing record.
+ * 0.5ms matches the backend's 500us threshold. */
+const MIRROR_TIME_TOLERANCE_MS = 0.5
+
+export type CallProxyRole =
+  | "canonical"
+  | "hop"
+
+export interface CallGrouping {
+  /** Calls visible in the default (folded) view — every direct call
+   * plus the canonical leg of every detected group. Same order as the
+   * input. */
+  visible: AgentTurnCallItem[]
+  /** Map from canonical call id → its hidden peers (in time order).
+   * Used to render "(+N hops)" badges next to each canonical. */
+  hopsByCanonical: Map<string, AgentTurnCallItem[]>
+  /** Sequence numbers of every hidden hop. Used to grey them out in
+   * the GanttNav when the user toggles "show hops" back on. */
+  hopSequences: Set<number>
+  /** How many calls would be hidden in the folded view. The toggle
+   * UI uses this to label the button "(N hidden)" so the user knows
+   * the fold is doing something even when groups span the full list. */
+  hopCount: number
+}
+
+function contentKey(c: AgentTurnCallItem): string {
+  // Joined string is the cheapest stable hash for HashMap-like
+  // bucketing in JS. Token nulls intentionally stringify to "null"
+  // so two equally-tokenless calls still cluster.
+  //
+  // Fields intentionally NOT in the key (all observed live):
+  //
+  // * `request_path` — proxies routinely rewrite the URL prefix
+  //   (`/v1/chat/completions` ↔ `/chat/completions` ↔ `/v1/messages`
+  //   etc., depending on which SDK each side speaks).
+  //
+  // * `model` — LiteLLM advertises a "model alias" to the client
+  //   (e.g. `glm5`) and rewrites it to the upstream's canonical name
+  //   (`GLM-5.1`) before forwarding. Surfaced in the Proxy view tab.
+  //
+  // * `wire_api` — LiteLLM (and other LLM proxies) translate across
+  //   API styles. The client may speak Anthropic at LiteLLM's ingress
+  //   while LiteLLM speaks OpenAI to the upstream. Same logical call,
+  //   different `wire_api` per captured leg.
+  //
+  // * `finish_reason` — translates alongside the API. Anthropic uses
+  //   `end_turn` / `tool_use` / `max_tokens`; OpenAI uses `stop` /
+  //   `tool_calls` / `length`. Anthropic→OpenAI proxies map them, so
+  //   each leg carries the value its side speaks.
+  //
+  // The remaining fields (status_code, is_stream, input_tokens,
+  // output_tokens) are the API-format-invariant ones — proxies pass
+  // them through unchanged. Combined with the time window (≤100ms)
+  // and the distinct-5-tuple requirement, this is a sufficiently
+  // narrow rule in practice; two unrelated calls happening to share
+  // exact token counts AND status code AND stream flag inside 100ms
+  // from different network views is effectively nil.
+  return [
+    c.is_stream ? "S" : "N",
+    c.status_code ?? "null",
+    c.input_tokens ?? "null",
+    c.output_tokens ?? "null",
+  ].join("\x1f")
+}
+
+function netView(c: AgentTurnCallItem): string {
+  return `${c.client_ip}:${c.client_port}->${c.server_ip}:${c.server_port}`
+}
+
+function spanMs(c: AgentTurnCallItem): number {
+  const end = c.complete_time ?? c.response_time ?? c.request_time
+  return end - c.request_time
+}
+
+/**
+ * Compute the call-level fold for one turn's call list. Pure function:
+ * runs in O(n^2) per content bucket but in practice each bucket is
+ * tiny (≤ pair size), so total work is linear.
+ *
+ * Rules (must all hold for two calls to pair):
+ *   - identical content fingerprint (wire_api, model, tokens, finish,
+ *     stream flag, status code, path)
+ *   - |request_time gap| ≤ MAX_REQ_TIME_GAP_MS
+ *   - different (client_ip:port, server_ip:port)
+ *
+ * Within a cluster of ≥2 calls, the canonical is the longest-span
+ * call (client-facing leg sees the full proxy round-trip). Ties on
+ * span go to the lex-smallest call id (deterministic re-runs).
+ */
+export function groupCalls(calls: AgentTurnCallItem[]): CallGrouping {
+  // Bucket by content fingerprint.
+  const buckets = new Map<string, AgentTurnCallItem[]>()
+  for (const c of calls) {
+    const k = contentKey(c)
+    const list = buckets.get(k)
+    if (list) list.push(c)
+    else buckets.set(k, [c])
+  }
+
+  // For each bucket, time-cluster contiguous-in-time entries.
+  const claimed = new Set<string>()
+  const hopsByCanonical = new Map<string, AgentTurnCallItem[]>()
+  const hopSequences = new Set<number>()
+
+  for (const bucket of buckets.values()) {
+    if (bucket.length < 2) continue
+    const sorted = bucket.slice().sort((a, b) => a.request_time - b.request_time)
+    for (let i = 0; i < sorted.length; i++) {
+      const a = sorted[i]
+      if (claimed.has(a.id)) continue
+      // Greedily collect peers within the time window having a distinct
+      // network view. We allow more than one peer (haproxy 3-leg).
+      const peers: AgentTurnCallItem[] = []
+      const seenViews = new Set<string>([netView(a)])
+      for (let j = i + 1; j < sorted.length; j++) {
+        const b = sorted[j]
+        if (claimed.has(b.id)) continue
+        if (b.request_time - a.request_time > MAX_REQ_TIME_GAP_MS) break
+        const bView = netView(b)
+        if (seenViews.has(bView)) continue
+        peers.push(b)
+        seenViews.add(bView)
+      }
+      if (peers.length === 0) continue
+
+      // Pick canonical: widest span; tie → lex smallest id.
+      const cluster = [a, ...peers]
+      let canon = cluster[0]
+      let canonSpan = spanMs(cluster[0])
+      for (const c of cluster.slice(1)) {
+        const s = spanMs(c)
+        if (s > canonSpan || (s === canonSpan && c.id < canon.id)) {
+          canon = c
+          canonSpan = s
+        }
+      }
+      const hops = cluster.filter((c) => c.id !== canon.id)
+      hops.sort((a, b) => a.request_time - b.request_time)
+      hopsByCanonical.set(canon.id, hops)
+      for (const h of hops) {
+        claimed.add(h.id)
+        hopSequences.add(h.sequence)
+      }
+      claimed.add(canon.id)
+      // Drop unused `MIRROR_TIME_TOLERANCE_MS` reference to silence
+      // unused-var lint while keeping the constant available for
+      // future role-naming work (see backend `proxy_pair` module).
+      void MIRROR_TIME_TOLERANCE_MS
+    }
+  }
+
+  const visible = calls.filter((c) => !hopSequences.has(c.sequence))
+  return {
+    visible,
+    hopsByCanonical,
+    hopSequences,
+    hopCount: hopSequences.size,
+  }
+}
diff --git a/console/src/lib/proxy-meta.ts b/console/src/lib/proxy-meta.ts
new file mode 100644
index 0000000..3b1373e
--- /dev/null
+++ b/console/src/lib/proxy-meta.ts
@@ -0,0 +1,43 @@
+/**
+ * Helpers for reading the pair-sweeper's `metadata.proxy` block off a
+ * turn detail / turn list item. The metadata column is open-ended JSON
+ * (typed `unknown` in the API), so callers walk it defensively.
+ *
+ * Lives outside any single component because both the agent-turn detail
+ * panel and the GanttNav surface multi-leg indicators.
+ */
+
+export type ProxyRole =
+  | "proxy_in"
+  | "proxy_out"
+  | "mirror_primary"
+  | "mirror_secondary"
+
+export interface ProxyMeta {
+  role: ProxyRole | string
+  pair_id?: string
+  peer_turn_id?: string
+  peer_turn_ids?: string[]
+}
+
+/** Pull the `metadata.proxy` block out of an arbitrary JSON-ish value.
+ * Returns `null` when no metadata.proxy block is present (direct turn). */
+export function readProxyMeta(metadata: unknown): ProxyMeta | null {
+  if (!metadata || typeof metadata !== "object") return null
+  const proxy = (metadata as Record<string, unknown>).proxy
+  if (!proxy || typeof proxy !== "object") return null
+  const role = (proxy as Record<string, unknown>).role
+  if (typeof role !== "string") return null
+  return proxy as unknown as ProxyMeta
+}
+
+/** Number of legs in a turn's proxy group, including the turn itself.
+ * Returns 0 when the turn is not part of any group. */
+export function proxyGroupSize(proxy: ProxyMeta | null): number {
+  if (!proxy) return 0
+  if (proxy.peer_turn_ids && proxy.peer_turn_ids.length > 0) {
+    return proxy.peer_turn_ids.length + 1
+  }
+  if (proxy.peer_turn_id) return 2
+  return 1
+}
diff --git a/console/src/pages/agent-turn-detail-panel.tsx b/console/src/pages/agent-turn-detail-panel.tsx
index 93701d1..07d4ad8 100644
--- a/console/src/pages/agent-turn-detail-panel.tsx
+++ b/console/src/pages/agent-turn-detail-panel.tsx
@@ -1,12 +1,32 @@
-import { useEffect, useMemo } from "react"
-import { Loader2 } from "lucide-react"
+import { useEffect, useMemo, useState } from "react"
+import { Loader2, ArrowLeftRight, Layers } from "lucide-react"
+import { cn } from "@/lib/utils"
 import { useAgentTurnDetail, useAgentTurnCalls } from "@/hooks/use-agent-turns"
 import { useTurnUrlState } from "@/hooks/use-turn-url-state"
 import { LlmCallDetailPanel } from "./llm-call-detail-panel"
 import { TopBar, StatsCards, GanttNav, CallCard } from "@/components/turn-detail"
+import { ProxyViewTab } from "@/components/turn-detail/proxy-view-tab"
 import { buildToolIndex } from "@/lib/turn-index"
+import { groupCalls } from "@/lib/call-pair"
 import type { AgentTurnDetail, AgentTurnCallItem } from "@/types/api"
 
+type DetailTab = "calls" | "proxy"
+
+/** Read `metadata.proxy.role` off a turn detail — present only when the
+ * backend pair sweeper has classified this turn as part of a proxy
+ * group. We surface the "Proxy View" tab solely on that condition.
+ *
+ * `AgentTurnDetail.metadata` is `unknown`-typed at the TS level (the
+ * shape is open-ended JSON), so we walk it defensively. */
+function readProxyRole(turn: AgentTurnDetail): string | null {
+  const meta = turn.metadata
+  if (!meta || typeof meta !== "object") return null
+  const proxy = (meta as Record<string, unknown>).proxy
+  if (!proxy || typeof proxy !== "object") return null
+  const role = (proxy as Record<string, unknown>).role
+  return typeof role === "string" ? role : null
+}
+
 interface Props {
   id: string
   onClose: () => void
@@ -15,23 +35,37 @@ interface Props {
 function TurnDetailView({
   turn,
   calls,
+  renderedCalls,
   loadingCalls,
   liteMode,
   activeSeq,
   onSelect,
   onOpenDetail,
+  foldHops,
+  setFoldHops,
+  hopsByCanonical,
+  hopCount,
 }: {
   turn: AgentTurnDetail
+  /** Full call list — used for indexing tools etc. */
   calls: AgentTurnCallItem[]
+  /** Calls to render in the list/timeline (full list, or canonical-only
+   * when foldHops is on). Sibling GanttNav uses the same view. */
+  renderedCalls: AgentTurnCallItem[]
   loadingCalls: boolean
   liteMode: boolean
   activeSeq: number | null
   onSelect: (seq: number) => void
   onOpenDetail: (id: string) => void
+  foldHops: boolean
+  setFoldHops: (v: boolean) => void
+  hopsByCanonical: Map<string, AgentTurnCallItem[]>
+  hopCount: number
 }) {
   const toolIndex = useMemo(() => buildToolIndex(calls), [calls])
-
   const userCallId = turn.user_call_id ?? calls[0]?.id ?? null
+  const proxyRole = readProxyRole(turn)
+  const [tab, setTab] = useState<DetailTab>("calls")
 
   return (
     <div className="flex h-full flex-col overflow-hidden">
@@ -42,48 +76,118 @@ function TurnDetailView({
           onJumpToSlowest={onSelect}
         />
       </div>
-      <div className="min-h-0 flex-1 overflow-y-auto p-4">
-        <div className="flex flex-col gap-3">
-          {liteMode && (
-            <div className="rounded-md border border-amber-300 bg-amber-50 px-3 py-2 text-xs text-amber-900 dark:border-amber-700/60 dark:bg-amber-900/20 dark:text-amber-200">
-              Large turn ({turn.call_count} calls) — request/response bodies
-              omitted from the list. Expand any call to fetch its bodies on
-              demand.
-            </div>
-          )}
-          {loadingCalls && calls.length === 0 ? (
-            <>
-              {[0, 1, 2].map((i) => (
-                <div key={i} className="h-12 animate-pulse rounded-lg border border-border bg-muted/40" />
-              ))}
-            </>
-          ) : (
-            calls.map((c) => (
-              <CallCard
-                key={c.id}
-                call={c}
-                turn={turn}
-                toolIndex={toolIndex}
-                isFirstCall={c.id === userCallId}
-                active={c.sequence === activeSeq}
-                defaultExpanded={
-                  c.sequence === activeSeq ||
-                  c.id === userCallId ||
-                  c.id === turn.final_call_id
-                }
-                onOpenDetail={onOpenDetail}
-              />
-            ))
-          )}
-          {!loadingCalls && calls.length === 0 && (
-            <p className="text-center text-xs text-muted-foreground">No calls</p>
-          )}
-        </div>
+      <div className="flex shrink-0 items-center gap-2 border-b border-border px-4">
+        {/* Tab bar shows whenever there's ANY pairing — backend
+            turn-level (proxyRole) OR client-side in-turn fold
+            (hopCount > 0). The Proxy view tab renders different
+            content for each case (see ProxyViewTab). */}
+        {(proxyRole || hopCount > 0) && (
+          <>
+            <TabButton active={tab === "calls"} onClick={() => setTab("calls")}>
+              Calls
+            </TabButton>
+            <TabButton active={tab === "proxy"} onClick={() => setTab("proxy")}>
+              <ArrowLeftRight className="size-3" />
+              Proxy view
+            </TabButton>
+          </>
+        )}
+        {tab === "calls" && hopCount > 0 && (
+          <label
+            className="ml-auto inline-flex cursor-pointer select-none items-center gap-1.5 py-2 text-xs text-muted-foreground hover:text-foreground"
+            title={
+              foldHops
+                ? `${hopCount} duplicate call leg(s) folded — show them?`
+                : "Hide proxy-duplicated legs and keep one row per logical call"
+            }
+          >
+            <input
+              type="checkbox"
+              checked={!foldHops}
+              onChange={(e) => setFoldHops(!e.target.checked)}
+              className="size-3"
+            />
+            <Layers className="size-3" />
+            Show proxy hops ({hopCount})
+          </label>
+        )}
+      </div>
+      <div className="min-h-0 flex-1 overflow-y-auto">
+        {tab === "proxy" && (proxyRole || hopCount > 0) ? (
+          <ProxyViewTab
+            turnId={turn.turn_id}
+            hasBackendPair={Boolean(proxyRole)}
+            canonicalCalls={renderedCalls}
+            hopsByCanonical={hopsByCanonical}
+          />
+        ) : (
+          <div className="flex flex-col gap-3 p-4">
+            {liteMode && (
+              <div className="rounded-md border border-amber-300 bg-amber-50 px-3 py-2 text-xs text-amber-900 dark:border-amber-700/60 dark:bg-amber-900/20 dark:text-amber-200">
+                Large turn ({turn.call_count} calls) — request/response bodies
+                omitted from the list. Expand any call to fetch its bodies on
+                demand.
+              </div>
+            )}
+            {loadingCalls && calls.length === 0 ? (
+              <>
+                {[0, 1, 2].map((i) => (
+                  <div key={i} className="h-12 animate-pulse rounded-lg border border-border bg-muted/40" />
+                ))}
+              </>
+            ) : (
+              renderedCalls.map((c) => (
+                <CallCard
+                  key={c.id}
+                  call={c}
+                  turn={turn}
+                  toolIndex={toolIndex}
+                  isFirstCall={c.id === userCallId}
+                  active={c.sequence === activeSeq}
+                  defaultExpanded={
+                    c.sequence === activeSeq ||
+                    c.id === userCallId ||
+                    c.id === turn.final_call_id
+                  }
+                  onOpenDetail={onOpenDetail}
+                  hopCount={hopsByCanonical.get(c.id)?.length ?? 0}
+                />
+              ))
+            )}
+            {!loadingCalls && renderedCalls.length === 0 && (
+              <p className="text-center text-xs text-muted-foreground">No calls</p>
+            )}
+          </div>
+        )}
       </div>
     </div>
   )
 }
 
+function TabButton({
+  active,
+  onClick,
+  children,
+}: {
+  active: boolean
+  onClick: () => void
+  children: React.ReactNode
+}) {
+  return (
+    <button
+      onClick={onClick}
+      className={cn(
+        "flex items-center gap-1.5 border-b-2 px-3 py-2 text-xs font-medium transition-colors",
+        active
+          ? "border-foreground text-foreground"
+          : "border-transparent text-muted-foreground hover:text-foreground",
+      )}
+    >
+      {children}
+    </button>
+  )
+}
+
 /// Above this call_count threshold, the calls list switches to lite
 /// mode — server NULLs the four heavy body/header fields so a
 /// mega-turn (hundreds of agentic iterations × hundreds of KB
@@ -98,6 +202,16 @@ export function AgentTurnDetailPanel({ id, onClose }: Props) {
   const liteMode = (turn?.call_count ?? 0) > CALLS_LITE_THRESHOLD
   const { data: calls = [], isLoading: loadingCalls } = useAgentTurnCalls(id, liteMode)
 
+  // Call-level proxy-duplicate fold: when two captured calls represent
+  // the same LLM round-trip (e.g. client→litellm + litellm→upstream),
+  // hide the upstream-facing leg by default. Toggle exposed in
+  // TurnDetailView below the StatsCards. Shared between GanttNav and
+  // the CallCard list so the timeline matches what's rendered to the
+  // right.
+  const [foldHops, setFoldHops] = useState(true)
+  const callGrouping = useMemo(() => groupCalls(calls), [calls])
+  const renderedCalls = foldHops ? callGrouping.visible : calls
+
   const { call: activeSeq, detail, setCall, setDetail, openDetail } = useTurnUrlState()
 
   const activeCall = activeSeq != null
@@ -176,8 +290,16 @@ export function AgentTurnDetailPanel({ id, onClose }: Props) {
           </div>
         ) : (
           <div className="flex flex-1 overflow-hidden">
-            {/* Left panel — Gantt nav */}
-            <GanttNav turn={turn} calls={calls} activeSequence={activeSeq} onSelect={handleSelect} />
+            {/* Left panel — Gantt nav, filtered by the same fold rule.
+                hopsByCanonical lights up a "+N hops" overlay on bars
+                whose duplicates are currently folded. */}
+            <GanttNav
+              turn={turn}
+              calls={renderedCalls}
+              activeSequence={activeSeq}
+              onSelect={handleSelect}
+              hopsByCanonical={foldHops ? callGrouping.hopsByCanonical : undefined}
+            />
 
             {/* Right panel */}
             <section className="flex flex-1 flex-col overflow-hidden">
@@ -187,11 +309,16 @@ export function AgentTurnDetailPanel({ id, onClose }: Props) {
                 <TurnDetailView
                   turn={turn}
                   calls={calls}
+                  renderedCalls={renderedCalls}
                   loadingCalls={loadingCalls}
                   liteMode={liteMode}
                   activeSeq={activeSeq}
                   onSelect={handleSelect}
                   onOpenDetail={openCallDetail}
+                  foldHops={foldHops}
+                  setFoldHops={setFoldHops}
+                  hopsByCanonical={callGrouping.hopsByCanonical}
+                  hopCount={callGrouping.hopCount}
                 />
               </div>
             </section>
diff --git a/console/src/pages/agent-turns.tsx b/console/src/pages/agent-turns.tsx
index 2952a26..24e4692 100644
--- a/console/src/pages/agent-turns.tsx
+++ b/console/src/pages/agent-turns.tsx
@@ -7,6 +7,7 @@ import { useSearchParamState } from "@/hooks/use-search-param-state"
 import { formatDateTimeMs, formatNumber, formatDuration } from "@/lib/format"
 import { TurnStatusBadge } from "@/components/ui/turn-status-badge"
 import { FilterDropdown } from "@/components/ui/filter-dropdown"
+import { ProxyBadge } from "@/components/ui/proxy-badge"
 import { AgentTurnDetailPanel } from "./agent-turn-detail-panel"
 import type { AgentTurnListItem } from "@/types/api"
 
@@ -42,7 +43,12 @@ function SortIcon({ column, sortBy, sortOrder }: { column: string; sortBy: strin
 function CellValue({ item, column }: { item: AgentTurnListItem; column: (typeof columns)[number]["key"] }) {
   switch (column) {
     case "start_time":
-      return <span className="tabular-nums">{formatDateTimeMs(item.start_time)}</span>
+      return (
+        <span className="inline-flex items-center gap-2">
+          <span className="tabular-nums">{formatDateTimeMs(item.start_time)}</span>
+          <ProxyBadge item={item} />
+        </span>
+      )
     case "wire_api":
       return (
         <span className="truncate" title={item.wire_api}>
@@ -92,6 +98,11 @@ export function AgentTurnsPage() {
   const [statusStr, setStatusStr] = useSearchParamState("status", "")
   const [agentKindStr, setAgentKindStr] = useSearchParamState("agent_kind", "")
   const [clientIpStr, setClientIpStr] = useSearchParamState("client_ip", "")
+  // Default off — the user wanted the folded view as the primary
+  // experience. URL serialization keeps "show hops" sticky on a
+  // shared link.
+  const [showHopsStr, setShowHopsStr] = useSearchParamState("show_hops", "")
+  const includeProxyHops = showHopsStr === "1"
 
   const page = Number(pageStr) || 1
   const pageSize = Number(pageSizeStr) || 50
@@ -128,6 +139,7 @@ export function AgentTurnsPage() {
     status: statusStr || undefined,
     agentKind: agentKindStr || undefined,
     clientIp: clientIpStr || undefined,
+    includeProxyHops,
   })
 
   const items = data?.items ?? []
@@ -180,6 +192,21 @@ export function AgentTurnsPage() {
           placeholder="Client IP (CSV)"
           className="w-[180px] rounded-lg border border-border bg-background px-2.5 py-1.5 text-xs placeholder:text-muted-foreground focus:border-foreground/20 focus:outline-none"
         />
+        <label
+          className="inline-flex cursor-pointer select-none items-center gap-1.5 rounded-lg border border-border px-2.5 py-1.5 text-xs hover:bg-muted"
+          title="Show the upstream/mirror leg of llmproxy duplicates (hidden by default)"
+        >
+          <input
+            type="checkbox"
+            checked={includeProxyHops}
+            onChange={(e) => {
+              setShowHopsStr(e.target.checked ? "1" : "")
+              setPageStr("1")
+            }}
+            className="size-3"
+          />
+          Show proxy hops
+        </label>
       </div>
 
       {/* Table */}
diff --git a/console/src/types/api.ts b/console/src/types/api.ts
index da60fcd..2fda171 100644
--- a/console/src/types/api.ts
+++ b/console/src/types/api.ts
@@ -106,6 +106,73 @@ export interface AgentTurnListItem {
   final_finish_reason: string | null
   user_input_preview: string | null
   final_answer_preview: string | null
+  /** Set by the backend pair sweeper when this turn is one leg of a
+   * llmproxy duplicate pair. `"proxy_in"` / `"mirror_primary"` legs are
+   * the canonical (visible) members; `"proxy_out"` / `"mirror_secondary"`
+   * are hidden by default and only returned when the API is asked with
+   * `include_proxy_hops=true`. Absent on direct (non-proxied) turns. */
+  proxy_role?: "proxy_in" | "proxy_out" | "mirror_primary" | "mirror_secondary"
+  /** `turn_id` of the first matched peer leg (for backward compat).
+   * For groups of >2 turns (haproxy 3-leg case), read
+   * `proxy_peer_turn_ids` for the full list. */
+  proxy_peer_turn_id?: string
+  /** Every other member of this turn's proxy group, sorted lex. The
+   * haproxy 3-leg case shows 2 peers here (br0 mirror + upstream hop). */
+  proxy_peer_turn_ids?: string[]
+}
+
+// ---- Proxy view (multi-leg fold detail) ----
+
+export interface ProxyViewMember {
+  turn_id: string
+  role: "proxy_in" | "proxy_out" | "mirror_primary" | "mirror_secondary" | string
+  client_ip: string
+  client_port: number | null
+  server_ip: string
+  server_port: number | null
+  start_time: number
+  end_time: number
+  duration_ms: number
+  ttft_ms: number | null
+  e2e_latency_ms: number | null
+  request_model: string | null
+  wire_api: string
+  request_path: string | null
+  status_code: number | null
+  request_headers: [string, string][]
+  response_headers: [string, string][]
+}
+
+export interface HeaderValueByLeg {
+  turn_id: string
+  role: string
+  value: string
+}
+
+export interface HeaderDiffEntry {
+  name: string
+  kind: "common" | "modified" | "per_leg"
+  values: HeaderValueByLeg[]
+}
+
+export interface ModelRewrite {
+  client_requested: string | null
+  upstream_received: string | null
+}
+
+export interface LatencyBreakdown {
+  client_observed_ms: number | null
+  upstream_observed_ms: number | null
+  proxy_overhead_ms: number | null
+}
+
+export interface ProxyViewResponse {
+  group_id: string
+  members: ProxyViewMember[]
+  request_header_diff: HeaderDiffEntry[]
+  response_header_diff: HeaderDiffEntry[]
+  model_rewrite?: ModelRewrite
+  latency_breakdown: LatencyBreakdown
 }
 
 export interface AgentTurnDetail {
diff --git a/server/app/tokenscope/src/pipeline.rs b/server/app/tokenscope/src/pipeline.rs
index 0a89b64..0b3c853 100644
--- a/server/app/tokenscope/src/pipeline.rs
+++ b/server/app/tokenscope/src/pipeline.rs
@@ -511,7 +511,7 @@ impl Pipeline {
             turns_rx,
             metrics_out_rx,
             http_exchanges_rx,
-            storage,
+            storage.clone(),
             storage_metrics,
         );
         stage_handles.push((
@@ -523,6 +523,22 @@ impl Pipeline {
             sink_handle,
         ));
 
+        // Pair-detection sweeper — scans recently-finalized turns for
+        // llmproxy duplicates (real haproxy hops + multi-interface
+        // double-capture) and folds them by writing pair annotations
+        // back to `agent_turns.metadata`. Runs forever, owns its own
+        // Arc<dyn StorageBackend>.
+        let pair_sweeper_handle =
+            ts_storage::spawn_pair_sweeper(ts_storage::PairSweeperConfig::default(), storage);
+        stage_handles.push((
+            StageTask {
+                stage: "pair_sweeper",
+                shard: None,
+                pipeline: None,
+            },
+            pair_sweeper_handle,
+        ));
+
         Pipeline {
             pipeline_txs,
             pipeline_sources,
diff --git a/server/ts-api/src/lib.rs b/server/ts-api/src/lib.rs
index cd5b940..07e6258 100644
--- a/server/ts-api/src/lib.rs
+++ b/server/ts-api/src/lib.rs
@@ -153,6 +153,10 @@ pub fn router(
             "/api/agent-turns/{id}/calls",
             get(routes::agent_turns::calls),
         )
+        .route(
+            "/api/agent-turns/{id}/proxy-view",
+            get(routes::agent_turns::proxy_view),
+        )
         .with_state(agent_turns_state);
 
     let capture_routes = Router::new().route(
diff --git a/server/ts-api/src/routes/agent_turns.rs b/server/ts-api/src/routes/agent_turns.rs
index ec06528..09c9266 100644
--- a/server/ts-api/src/routes/agent_turns.rs
+++ b/server/ts-api/src/routes/agent_turns.rs
@@ -1,7 +1,12 @@
+use std::collections::BTreeMap;
+
 use axum::extract::State;
 use axum::response::IntoResponse;
 use serde::Deserialize;
-use ts_storage::query::{TurnListItem, TurnsQuery};
+use ts_storage::query::{
+    CallDetail, HeaderDiffEntry, HeaderDiffKind, HeaderValueByLeg, LatencyBreakdown,
+    ModelRewrite, ProxyViewMember, ProxyViewResponse, TurnDetail, TurnListItem, TurnsQuery,
+};
 use ts_turn::AgentTurn;
 
 use crate::extractors::{Path, Query};
@@ -33,6 +38,11 @@ pub struct TurnsParams {
     pub page: u32,
     #[serde(default = "default_page_size")]
     pub page_size: u32,
+    /// When true, return turns the pair sweeper has hidden (proxy_out /
+    /// mirror_secondary). Default false — the list folds duplicates by
+    /// default so the user sees one row per logical call.
+    #[serde(default)]
+    pub include_proxy_hops: bool,
 }
 
 fn default_turns_sort_by() -> String {
@@ -64,6 +74,7 @@ pub async fn list(
         sort_order: params.sort_order,
         page: params.page,
         page_size,
+        include_proxy_hops: params.include_proxy_hops,
     };
 
     let mut page = ctx.storage.query_turns(&query).await?;
@@ -139,6 +150,10 @@ fn collect_in_progress(ctx: &ApiAgentTurnsContext, query: &TurnsQuery) -> Vec<Tu
 }
 
 /// Convert a tracker-side `AgentTurn` to the API list response shape.
+/// In-progress turns never have a pair annotation yet — the sweeper
+/// only inspects finalized rows in the DB — so `proxy_role` /
+/// `proxy_peer_turn_id` are always `None` here. Once the turn
+/// finalizes and the sweeper sees it, the DB row carries the role.
 fn agent_turn_to_list_item(t: &AgentTurn) -> TurnListItem {
     TurnListItem {
         turn_id: t.turn_id.clone(),
@@ -160,6 +175,9 @@ fn agent_turn_to_list_item(t: &AgentTurn) -> TurnListItem {
         final_finish_reason: t.final_finish_reason.clone(),
         user_input_preview: t.user_input_preview.clone(),
         final_answer_preview: t.final_answer_preview.clone(),
+        proxy_role: None,
+        proxy_peer_turn_id: None,
+        proxy_peer_turn_ids: None,
     }
 }
 
@@ -287,3 +305,410 @@ pub async fn calls(
         .await?;
     Ok(ApiResponse::ok(items))
 }
+
+// ---- Proxy view ----
+//
+// Returns the multi-leg fold for one logical LLM call: every member of
+// the requested turn's `metadata.proxy.peer_turn_ids` group plus the
+// turn itself, with a header diff, optional model-rewrite annotation,
+// and a latency breakdown. Used by the Agent Turn detail panel's
+// "Proxy View" tab; the same response is suitable for diagnostics tooling
+// that wants to inspect what the proxy mutated.
+
+pub async fn proxy_view(
+    State(ctx): State<ApiAgentTurnsContext>,
+    Path(turn_id): Path<String>,
+) -> Result<impl IntoResponse, ApiError> {
+    let turn = match ctx.storage.query_turn_by_id(&turn_id).await? {
+        Some(t) => t,
+        None => return Err(ApiError::NotFound(format!("turn not found: {turn_id}"))),
+    };
+
+    let proxy = turn.metadata.as_ref().and_then(|m| m.get("proxy"));
+    let group_id = proxy
+        .and_then(|p| p.get("pair_id"))
+        .and_then(|v| v.as_str())
+        .ok_or_else(|| {
+            ApiError::NotFound(format!(
+                "turn {turn_id} is not part of a proxy group"
+            ))
+        })?
+        .to_string();
+    let mut peer_ids: Vec<String> = proxy
+        .and_then(|p| p.get("peer_turn_ids"))
+        .and_then(|v| v.as_array())
+        .map(|arr| arr.iter().filter_map(|s| s.as_str().map(String::from)).collect())
+        .unwrap_or_default();
+    // Backward compat: pre-N-leg writes only set peer_turn_id (a single
+    // string). If peer_turn_ids is empty but the legacy field is set,
+    // promote the singleton.
+    if peer_ids.is_empty() {
+        if let Some(legacy) = proxy.and_then(|p| p.get("peer_turn_id")).and_then(|v| v.as_str()) {
+            peer_ids.push(legacy.to_string());
+        }
+    }
+
+    let self_role = proxy
+        .and_then(|p| p.get("role"))
+        .and_then(|v| v.as_str())
+        .unwrap_or("unknown")
+        .to_string();
+
+    // Build the member list. Canonical (proxy_in / mirror_primary)
+    // goes first; remaining members preserve their lex order from
+    // peer_turn_ids. If the requested turn isn't the canonical, we
+    // still surface it as-is in its lex position — the role field
+    // tells the UI how to render it.
+    let mut order: Vec<(String, String)> = Vec::with_capacity(peer_ids.len() + 1);
+    order.push((turn_id.clone(), self_role));
+    for pid in &peer_ids {
+        // Resolve each peer's role by fetching its metadata.proxy.role.
+        // Cheap relative to the request bodies we're about to pull.
+        let peer_turn = ctx.storage.query_turn_by_id(pid).await?;
+        let role = peer_turn
+            .as_ref()
+            .and_then(|t| t.metadata.as_ref())
+            .and_then(|m| m.get("proxy"))
+            .and_then(|p| p.get("role"))
+            .and_then(|v| v.as_str())
+            .unwrap_or("unknown")
+            .to_string();
+        order.push((pid.clone(), role));
+    }
+    // Sort so the canonical-by-role goes first, then proxy_out, then
+    // mirror_secondary. Within the same role, lex by turn_id.
+    order.sort_by(|(a_id, a_role), (b_id, b_role)| {
+        role_sort_key(a_role)
+            .cmp(&role_sort_key(b_role))
+            .then_with(|| a_id.cmp(b_id))
+    });
+
+    // Fetch each member's TurnDetail + first call body.
+    let mut members: Vec<ProxyViewMember> = Vec::with_capacity(order.len());
+    for (tid, role) in &order {
+        let detail = match ctx.storage.query_turn_by_id(tid).await? {
+            Some(t) => t,
+            None => continue, // peer evicted by retention since the sweep — skip
+        };
+        let first_call_id = detail.call_ids.first().cloned();
+        let first_call: Option<CallDetail> = match first_call_id {
+            Some(ref id) => ctx.storage.query_call_by_id(id).await?,
+            None => None,
+        };
+        members.push(member_from(detail, role.clone(), first_call));
+    }
+
+    let request_header_diff = diff_headers(&members, |m| &m.request_headers);
+    let response_header_diff = diff_headers(&members, |m| &m.response_headers);
+    let model_rewrite = detect_model_rewrite(&members);
+    let latency_breakdown = compute_latency_breakdown(&members);
+
+    Ok(ApiResponse::ok(ProxyViewResponse {
+        group_id,
+        members,
+        request_header_diff,
+        response_header_diff,
+        model_rewrite,
+        latency_breakdown,
+    }))
+}
+
+/// Sort key — lower value goes first. Canonical roles surface above
+/// hops, which surface above mirrors.
+fn role_sort_key(role: &str) -> u8 {
+    match role {
+        "proxy_in" => 0,
+        "mirror_primary" => 1,
+        "proxy_out" => 2,
+        "mirror_secondary" => 3,
+        _ => 9,
+    }
+}
+
+fn member_from(
+    detail: TurnDetail,
+    role: String,
+    first_call: Option<CallDetail>,
+) -> ProxyViewMember {
+    let (request_headers, response_headers, client_port, server_port, request_path, status_code, ttft_ms, e2e_latency_ms, request_model) =
+        match first_call {
+            Some(c) => (
+                parse_headers_json(c.request_headers.as_deref()),
+                parse_headers_json(c.response_headers.as_deref()),
+                Some(c.client_port),
+                Some(c.server_port),
+                Some(c.request_path),
+                c.status_code,
+                c.ttft_ms,
+                c.e2e_latency_ms,
+                extract_model_from_body(c.request_body.as_deref()),
+            ),
+            None => (Vec::new(), Vec::new(), None, None, None, None, None, None, None),
+        };
+    ProxyViewMember {
+        turn_id: detail.turn_id,
+        role,
+        client_ip: detail.client_ip,
+        client_port,
+        server_ip: detail.server_ip,
+        server_port,
+        start_time: detail.start_time,
+        end_time: detail.end_time,
+        duration_ms: detail.duration_ms,
+        ttft_ms,
+        e2e_latency_ms,
+        request_model,
+        wire_api: detail.wire_api,
+        request_path,
+        status_code,
+        request_headers,
+        response_headers,
+    }
+}
+
+/// Headers are stored as a JSON-encoded `Vec<[name, value]>` in the
+/// `request_headers` / `response_headers` columns. Parse into a Vec
+/// preserving order; bail to empty if the blob is malformed or missing.
+fn parse_headers_json(blob: Option<&str>) -> Vec<(String, String)> {
+    let Some(s) = blob else {
+        return Vec::new();
+    };
+    serde_json::from_str::<Vec<(String, String)>>(s).unwrap_or_default()
+}
+
+/// Pull the `model` field out of a request body JSON. Used to surface
+/// the proxy's model rewrite (client sent X, proxy forwarded as Y).
+fn extract_model_from_body(body: Option<&str>) -> Option<String> {
+    let s = body?;
+    let v: serde_json::Value = serde_json::from_str(s).ok()?;
+    v.get("model").and_then(|m| m.as_str()).map(String::from)
+}
+
+/// Compute the cross-leg diff for one header dimension (request OR
+/// response). Each header NAME yields one `HeaderDiffEntry`. Header
+/// names are case-insensitively compared (HTTP semantics) but the
+/// canonical-case spelling of the first occurrence is preserved in the
+/// output.
+fn diff_headers<F>(members: &[ProxyViewMember], pick: F) -> Vec<HeaderDiffEntry>
+where
+    F: Fn(&ProxyViewMember) -> &[(String, String)],
+{
+    // Bucket: lowercased-name → (canonical_name, per-leg entries).
+    let mut by_name: BTreeMap<String, (String, Vec<HeaderValueByLeg>)> = BTreeMap::new();
+    for m in members {
+        for (name, value) in pick(m) {
+            let key = name.to_ascii_lowercase();
+            let entry = by_name
+                .entry(key)
+                .or_insert_with(|| (name.clone(), Vec::new()));
+            entry.1.push(HeaderValueByLeg {
+                turn_id: m.turn_id.clone(),
+                role: m.role.clone(),
+                value: value.clone(),
+            });
+        }
+    }
+    let leg_count = members.len();
+    let mut out = Vec::with_capacity(by_name.len());
+    for (_lc, (canonical_name, values)) in by_name {
+        let kind = if values.len() < leg_count {
+            HeaderDiffKind::PerLeg
+        } else {
+            // Every leg supplied this header at least once. Decide
+            // common vs modified by whether all values match.
+            let first = values.first().map(|v| v.value.as_str()).unwrap_or("");
+            if values.iter().all(|v| v.value == first) {
+                HeaderDiffKind::Common
+            } else {
+                HeaderDiffKind::Modified
+            }
+        };
+        out.push(HeaderDiffEntry {
+            name: canonical_name,
+            kind,
+            values,
+        });
+    }
+    out
+}
+
+/// If the canonical leg's request body advertised one model name and
+/// the proxy_out leg advertised another, surface the rewrite.
+fn detect_model_rewrite(members: &[ProxyViewMember]) -> Option<ModelRewrite> {
+    let canon = members
+        .iter()
+        .find(|m| m.role == "proxy_in" || m.role == "mirror_primary");
+    let upstream = members.iter().find(|m| m.role == "proxy_out");
+    match (canon, upstream) {
+        (Some(c), Some(u)) if c.request_model != u.request_model => Some(ModelRewrite {
+            client_requested: c.request_model.clone(),
+            upstream_received: u.request_model.clone(),
+        }),
+        _ => None,
+    }
+}
+
+fn compute_latency_breakdown(members: &[ProxyViewMember]) -> LatencyBreakdown {
+    let client = members
+        .iter()
+        .find(|m| m.role == "proxy_in" || m.role == "mirror_primary")
+        .and_then(|m| m.e2e_latency_ms);
+    let upstream = members
+        .iter()
+        .find(|m| m.role == "proxy_out")
+        .and_then(|m| m.e2e_latency_ms);
+    let overhead = match (client, upstream) {
+        (Some(c), Some(u)) => Some(c - u),
+        _ => None,
+    };
+    LatencyBreakdown {
+        client_observed_ms: client,
+        upstream_observed_ms: upstream,
+        proxy_overhead_ms: overhead,
+    }
+}
+
+#[cfg(test)]
+mod proxy_view_tests {
+    use super::*;
+
+    fn member(turn_id: &str, role: &str, model: Option<&str>, e2e: Option<f64>) -> ProxyViewMember {
+        ProxyViewMember {
+            turn_id: turn_id.into(),
+            role: role.into(),
+            client_ip: "x".into(),
+            client_port: None,
+            server_ip: "y".into(),
+            server_port: None,
+            start_time: 0,
+            end_time: 0,
+            duration_ms: 0,
+            ttft_ms: None,
+            e2e_latency_ms: e2e,
+            request_model: model.map(String::from),
+            wire_api: "openai-chat".into(),
+            request_path: None,
+            status_code: None,
+            request_headers: Vec::new(),
+            response_headers: Vec::new(),
+        }
+    }
+
+    fn h(name: &str, value: &str) -> (String, String) {
+        (name.into(), value.into())
+    }
+
+    #[test]
+    fn diff_headers_classifies_common_modified_and_per_leg() {
+        let mut m1 = member("t1", "proxy_in", None, None);
+        let mut m2 = member("t2", "proxy_out", None, None);
+        m1.response_headers = vec![
+            h("Content-Type", "application/json"),
+            h("X-LiteLLM-Call-Id", "abc-123"),  // proxy-added
+            h("Server", "uvicorn"),
+        ];
+        m2.response_headers = vec![
+            h("content-type", "application/json"), // case-insensitive match → Common
+            h("Server", "envoy"),                  // Modified
+            h("Anthropic-Request-Id", "req-9"),    // upstream-only
+        ];
+        let members = vec![m1, m2];
+        let diff = diff_headers(&members, |m| &m.response_headers);
+        let by_name: std::collections::HashMap<String, &HeaderDiffEntry> =
+            diff.iter().map(|e| (e.name.to_lowercase(), e)).collect();
+        assert!(matches!(
+            by_name["content-type"].kind,
+            HeaderDiffKind::Common
+        ));
+        assert!(matches!(by_name["server"].kind, HeaderDiffKind::Modified));
+        assert!(matches!(
+            by_name["x-litellm-call-id"].kind,
+            HeaderDiffKind::PerLeg
+        ));
+        assert!(matches!(
+            by_name["anthropic-request-id"].kind,
+            HeaderDiffKind::PerLeg
+        ));
+        // PerLeg entries carry the role of the leg that sent them — UI
+        // colors "x-litellm-call-id" by proxy_in (litellm injected),
+        // "anthropic-request-id" by proxy_out (upstream returned).
+        let litellm_entry = by_name["x-litellm-call-id"];
+        assert_eq!(litellm_entry.values.len(), 1);
+        assert_eq!(litellm_entry.values[0].role, "proxy_in");
+        let anth_entry = by_name["anthropic-request-id"];
+        assert_eq!(anth_entry.values.len(), 1);
+        assert_eq!(anth_entry.values[0].role, "proxy_out");
+    }
+
+    #[test]
+    fn detect_model_rewrite_surfaces_when_canonical_and_upstream_differ() {
+        // Realistic LiteLLM scenario: client requests
+        // "claude-3-5-sonnet-20241022", proxy forwards as "qwen36-27b".
+        let members = vec![
+            member("client", "proxy_in", Some("claude-3-5-sonnet-20241022"), None),
+            member("upstream", "proxy_out", Some("qwen36-27b"), None),
+        ];
+        let rewrite = detect_model_rewrite(&members).expect("rewrite detected");
+        assert_eq!(rewrite.client_requested.as_deref(), Some("claude-3-5-sonnet-20241022"));
+        assert_eq!(rewrite.upstream_received.as_deref(), Some("qwen36-27b"));
+    }
+
+    #[test]
+    fn detect_model_rewrite_returns_none_when_same() {
+        let members = vec![
+            member("a", "proxy_in", Some("GLM-5.1"), None),
+            member("b", "proxy_out", Some("GLM-5.1"), None),
+        ];
+        assert!(detect_model_rewrite(&members).is_none());
+    }
+
+    #[test]
+    fn compute_latency_breakdown_yields_proxy_overhead() {
+        let members = vec![
+            member("a", "proxy_in", None, Some(2294.0)),
+            member("b", "proxy_out", None, Some(2291.0)),
+        ];
+        let b = compute_latency_breakdown(&members);
+        assert_eq!(b.client_observed_ms, Some(2294.0));
+        assert_eq!(b.upstream_observed_ms, Some(2291.0));
+        assert_eq!(b.proxy_overhead_ms, Some(3.0));
+    }
+
+    #[test]
+    fn compute_latency_breakdown_returns_none_overhead_without_upstream() {
+        // Mirror-only group (br0 + docker0 capture, no proxy hop visible) —
+        // overhead can't be computed, but the canonical latency still
+        // surfaces.
+        let members = vec![
+            member("a", "mirror_primary", None, Some(2000.0)),
+            member("b", "mirror_secondary", None, Some(2000.5)),
+        ];
+        let b = compute_latency_breakdown(&members);
+        assert_eq!(b.client_observed_ms, Some(2000.0));
+        assert_eq!(b.upstream_observed_ms, None);
+        assert_eq!(b.proxy_overhead_ms, None);
+    }
+
+    #[test]
+    fn extract_model_from_body_handles_missing_field_gracefully() {
+        assert_eq!(extract_model_from_body(None), None);
+        assert_eq!(extract_model_from_body(Some("not json")), None);
+        assert_eq!(extract_model_from_body(Some(r#"{}"#)), None);
+        assert_eq!(
+            extract_model_from_body(Some(r#"{"model": "qwen36-27b"}"#)).as_deref(),
+            Some("qwen36-27b")
+        );
+    }
+
+    #[test]
+    fn parse_headers_json_round_trips_pairs() {
+        let blob = r#"[["X-A","1"],["X-B","2"]]"#;
+        let parsed = parse_headers_json(Some(blob));
+        assert_eq!(
+            parsed,
+            vec![("X-A".to_string(), "1".to_string()), ("X-B".to_string(), "2".to_string())]
+        );
+        assert!(parse_headers_json(None).is_empty());
+        assert!(parse_headers_json(Some("garbage")).is_empty());
+    }
+}
diff --git a/server/ts-storage-duckdb/src/lib.rs b/server/ts-storage-duckdb/src/lib.rs
index d4cea04..050f718 100644
--- a/server/ts-storage-duckdb/src/lib.rs
+++ b/server/ts-storage-duckdb/src/lib.rs
@@ -20,7 +20,7 @@ use ts_common::error::{AppError, Result};
 use ts_llm::model::LlmCall;
 use ts_metrics::model::{LlmFinishMetric, LlmMetric};
 use ts_protocol::HttpExchange;
-use ts_turn::AgentTurn;
+use ts_turn::{AgentTurn, PairCandidate};
 
 use ts_storage::query::*;
 use ts_storage::retention::{RetentionPolicy, RetentionReport};
@@ -245,4 +245,20 @@ impl StorageBackend for DuckDbBackend {
     async fn apply_retention(&self, policy: RetentionPolicy) -> Result<RetentionReport> {
         DuckDbBackend::apply_retention(self, policy).await
     }
+
+    async fn query_pair_candidates(
+        &self,
+        start_us: i64,
+        end_us: i64,
+    ) -> Result<Vec<PairCandidate>> {
+        DuckDbBackend::query_pair_candidates(self, start_us, end_us).await
+    }
+
+    async fn update_turn_metadata(
+        &self,
+        turn_id: &str,
+        patch: serde_json::Value,
+    ) -> Result<()> {
+        DuckDbBackend::update_turn_metadata(self, turn_id, patch).await
+    }
 }
diff --git a/server/ts-storage-duckdb/src/turns.rs b/server/ts-storage-duckdb/src/turns.rs
index 41ea0fc..8057ba6 100644
--- a/server/ts-storage-duckdb/src/turns.rs
+++ b/server/ts-storage-duckdb/src/turns.rs
@@ -9,6 +9,43 @@ use crate::util::{
     extract_full_text, parse_json_string_list, us_to_timestamp, ExtractKind,
 };
 use crate::DuckDbBackend;
+use ts_turn::PairCandidate;
+
+/// Read `metadata.proxy.{role, peer_turn_id, peer_turn_ids}` out of a
+/// row's stored JSON. Returns all-`None` for direct turns (no
+/// metadata, malformed metadata, or proxy block absent). Centralized
+/// so the same parsing rule serves the list and detail handlers.
+///
+/// `peer_turn_ids` is the full sibling list (empty Vec when present
+/// but actually empty). For groups of size 2 this contains one
+/// element; for the haproxy 3-leg case, two.
+fn extract_proxy_fields(
+    metadata_raw: Option<String>,
+) -> (Option<String>, Option<String>, Option<Vec<String>>) {
+    let Some(text) = metadata_raw else {
+        return (None, None, None);
+    };
+    let Ok(v) = serde_json::from_str::<serde_json::Value>(&text) else {
+        return (None, None, None);
+    };
+    let proxy = v.get("proxy");
+    let role = proxy
+        .and_then(|p| p.get("role"))
+        .and_then(|r| r.as_str())
+        .map(String::from);
+    let peer_id = proxy
+        .and_then(|p| p.get("peer_turn_id"))
+        .and_then(|r| r.as_str())
+        .map(String::from);
+    let peer_ids = proxy.and_then(|p| p.get("peer_turn_ids")).and_then(|a| {
+        a.as_array().map(|arr| {
+            arr.iter()
+                .filter_map(|v| v.as_str().map(String::from))
+                .collect::<Vec<_>>()
+        })
+    });
+    (role, peer_id, peer_ids)
+}
 
 struct PreparedTurn {
     turn_id: String,
@@ -215,6 +252,20 @@ impl DuckDbBackend {
                     .collect();
                 where_parts.push(format!("server_ip IN ({})", list.join(", ")));
             }
+            if !query.include_proxy_hops {
+                // Default list view: hide the hop the sweeper marked as
+                // hidden (proxy_out + mirror_secondary). proxy_in /
+                // mirror_primary stay visible. Direct turns (no
+                // metadata.proxy.role) also stay visible because
+                // json_extract_string returns NULL and NULL NOT IN (...)
+                // is NULL → the IS NULL branch keeps them.
+                where_parts.push(
+                    "(json_extract_string(metadata, '$.proxy.role') IS NULL \
+                       OR json_extract_string(metadata, '$.proxy.role') \
+                          NOT IN ('proxy_out', 'mirror_secondary'))"
+                        .to_string(),
+                );
+            }
 
             let where_sql = where_parts.join(" AND ");
             let sort_by = &query.sort_by;
@@ -235,7 +286,7 @@ impl DuckDbBackend {
                  wire_api, agent_kind, models_used, call_count, \
                  total_input_tokens, total_output_tokens, status, \
                  final_finish_reason, user_input_preview, final_answer_preview, \
-                 client_ip, server_ip \
+                 client_ip, server_ip, metadata \
                  FROM agent_turns WHERE {where_sql} \
                  ORDER BY {sort_by} {sort_order} \
                  LIMIT {limit} OFFSET {offset}"
@@ -259,6 +310,11 @@ impl DuckDbBackend {
                     .map_err(|e| AppError::Storage(format!("read error: {e}")))?;
                 let models_used = parse_json_string_list(models_used_raw.as_deref());
                 let primary_model = models_used.first().cloned();
+                let metadata_raw: Option<String> = row
+                    .get(18)
+                    .map_err(|e| AppError::Storage(format!("read metadata: {e}")))?;
+                let (proxy_role, proxy_peer_turn_id, proxy_peer_turn_ids) =
+                    extract_proxy_fields(metadata_raw);
                 items.push(TurnListItem {
                     turn_id: row
                         .get(0)
@@ -313,6 +369,9 @@ impl DuckDbBackend {
                     final_answer_preview: row
                         .get::<_, Option<String>>(15)
                         .map_err(|e| AppError::Storage(format!("read error: {e}")))?,
+                    proxy_role,
+                    proxy_peer_turn_id,
+                    proxy_peer_turn_ids,
                 });
             }
 
@@ -481,6 +540,154 @@ impl DuckDbBackend {
         .await
         .map_err(|e| AppError::Storage(format!("spawn_blocking failed: {e}")))?
     }
+
+    /// Light projection of `agent_turns` rows for pair-detection. Skips
+    /// rows whose `metadata` already encodes a `proxy.role`.
+    pub(crate) async fn query_pair_candidates(
+        &self,
+        start_us: i64,
+        end_us: i64,
+    ) -> Result<Vec<PairCandidate>> {
+        let conn = self.read_pool.acquire().await?;
+        tokio::task::spawn_blocking(move || {
+            let start_ts = us_to_timestamp(start_us);
+            let end_ts = us_to_timestamp(end_us);
+            // metadata is stored as VARCHAR holding a JSON document.
+            // `json_extract_string(metadata, '$.proxy.role')` returns the
+            // string at that path, or NULL if absent. Filtering out rows
+            // that already carry a role keeps repeat-sweeps idempotent.
+            let sql = "
+                SELECT turn_id, session_id, agent_kind, wire_api,
+                       epoch_ms(start_time) * 1000 AS start_us,
+                       epoch_ms(end_time) * 1000 AS end_us,
+                       call_count,
+                       total_input_tokens, total_output_tokens,
+                       final_finish_reason,
+                       models_used,
+                       client_ip, server_ip
+                  FROM agent_turns
+                 WHERE start_time >= ?
+                   AND start_time <  ?
+                   AND (metadata IS NULL
+                        OR json_extract_string(metadata, '$.proxy.role') IS NULL)
+                 ORDER BY start_time ASC
+            ";
+            let mut stmt = conn
+                .prepare(sql)
+                .map_err(|e| AppError::Storage(format!("prepare pair candidates: {e}")))?;
+            let mut rows = stmt
+                .query(duckdb::params![start_ts, end_ts])
+                .map_err(|e| AppError::Storage(format!("query pair candidates: {e}")))?;
+            let mut out = Vec::new();
+            while let Some(row) = rows
+                .next()
+                .map_err(|e| AppError::Storage(format!("row error: {e}")))?
+            {
+                let models_raw: Option<String> = row
+                    .get(10)
+                    .map_err(|e| AppError::Storage(format!("read models: {e}")))?;
+                let models = parse_json_string_list(models_raw.as_deref());
+                let primary_model = models.first().cloned();
+                let client_ip: String = row
+                    .get(11)
+                    .map_err(|e| AppError::Storage(format!("read client_ip: {e}")))?;
+                let server_ip: String = row
+                    .get(12)
+                    .map_err(|e| AppError::Storage(format!("read server_ip: {e}")))?;
+                out.push(PairCandidate {
+                    turn_id: row
+                        .get(0)
+                        .map_err(|e| AppError::Storage(format!("read turn_id: {e}")))?,
+                    session_id: row
+                        .get(1)
+                        .map_err(|e| AppError::Storage(format!("read session_id: {e}")))?,
+                    agent_kind: row
+                        .get(2)
+                        .map_err(|e| AppError::Storage(format!("read agent_kind: {e}")))?,
+                    wire_api: row
+                        .get(3)
+                        .map_err(|e| AppError::Storage(format!("read wire_api: {e}")))?,
+                    start_time_us: row
+                        .get(4)
+                        .map_err(|e| AppError::Storage(format!("read start_us: {e}")))?,
+                    end_time_us: row
+                        .get(5)
+                        .map_err(|e| AppError::Storage(format!("read end_us: {e}")))?,
+                    call_count: row
+                        .get(6)
+                        .map_err(|e| AppError::Storage(format!("read call_count: {e}")))?,
+                    total_input_tokens: row
+                        .get(7)
+                        .map_err(|e| AppError::Storage(format!("read in_tok: {e}")))?,
+                    total_output_tokens: row
+                        .get(8)
+                        .map_err(|e| AppError::Storage(format!("read out_tok: {e}")))?,
+                    final_finish_reason: row
+                        .get::<_, Option<String>>(9)
+                        .map_err(|e| AppError::Storage(format!("read finish: {e}")))?,
+                    primary_model,
+                    network_view: format!("{}->{}", client_ip, server_ip),
+                });
+            }
+            Ok(out)
+        })
+        .await
+        .map_err(|e| AppError::Storage(format!("spawn_blocking failed: {e}")))?
+    }
+
+    /// Read-modify-write `agent_turns.metadata` on a single row: merge
+    /// `patch` (shallow, top-level key replacement) into the existing
+    /// JSON object. No-op if `turn_id` doesn't exist — the sweeper may
+    /// race finalization and a target turn can be momentarily absent.
+    pub(crate) async fn update_turn_metadata(
+        &self,
+        turn_id: &str,
+        patch: serde_json::Value,
+    ) -> Result<()> {
+        let conn = self.write_turns_conn.clone();
+        let turn_id = turn_id.to_string();
+        tokio::task::spawn_blocking(move || {
+            let conn = conn
+                .lock()
+                .map_err(|e| AppError::Storage(format!("failed to lock writer: {e}")))?;
+            let existing: Option<Option<String>> = conn
+                .query_row(
+                    "SELECT metadata FROM agent_turns WHERE turn_id = ?",
+                    duckdb::params![turn_id],
+                    |r| r.get(0),
+                )
+                .ok();
+            let merged = match existing {
+                Some(Some(text)) => {
+                    let mut base = serde_json::from_str::<serde_json::Value>(&text)
+                        .ok()
+                        .unwrap_or_else(|| serde_json::json!({}));
+                    if !base.is_object() {
+                        base = serde_json::json!({});
+                    }
+                    if let (Some(obj), Some(patch_obj)) =
+                        (base.as_object_mut(), patch.as_object())
+                    {
+                        for (k, v) in patch_obj {
+                            obj.insert(k.clone(), v.clone());
+                        }
+                    }
+                    base
+                }
+                Some(None) => patch,
+                None => return Ok(()), // turn not present yet — drop silently
+            };
+            let merged_str = merged.to_string();
+            conn.execute(
+                "UPDATE agent_turns SET metadata = ? WHERE turn_id = ?",
+                duckdb::params![merged_str, turn_id],
+            )
+            .map_err(|e| AppError::Storage(format!("update turn metadata: {e}")))?;
+            Ok(())
+        })
+        .await
+        .map_err(|e| AppError::Storage(format!("spawn_blocking failed: {e}")))?
+    }
 }
 
 #[cfg(test)]
@@ -599,6 +806,7 @@ mod tests {
             sort_order: "desc".into(),
             page: 1,
             page_size: 50,
+            include_proxy_hops: false,
         }
     }
 
@@ -1223,4 +1431,178 @@ mod tests {
             "final_answer should be full text, not truncated preview"
         );
     }
+
+    #[tokio::test]
+    async fn query_pair_candidates_returns_only_unpaired() {
+        let backend = DuckDbBackend::open(":memory:").unwrap();
+        backend.init().await.unwrap();
+        let base = 1_700_000_000_000_000_i64;
+        let t1 = sample_turn(
+            "t1",
+            "s1",
+            wa::ANTHROPIC,
+            vec!["claude"],
+            base,
+            1000,
+            1,
+            vec!["c1"],
+            TurnStatus::Complete,
+        );
+        let mut t2 = sample_turn(
+            "t2",
+            "s1",
+            wa::ANTHROPIC,
+            vec!["claude"],
+            base + 1000,
+            1000,
+            1,
+            vec!["c2"],
+            TurnStatus::Complete,
+        );
+        // t2 already paired — sweeper should skip it.
+        t2.metadata = serde_json::json!({
+            "proxy": {
+                "role": "proxy_in",
+                "pair_id": "p-existing",
+                "peer_turn_id": "tX",
+            }
+        });
+        backend.write_turns(vec![t1, t2]).await.unwrap();
+
+        let cands = backend
+            .query_pair_candidates(base - 1, base + 2_000_000_000)
+            .await
+            .unwrap();
+        assert_eq!(cands.len(), 1);
+        assert_eq!(cands[0].turn_id, "t1");
+        assert_eq!(cands[0].session_id, "s1");
+        assert_eq!(cands[0].network_view, "127.0.0.1->127.0.0.1");
+        assert_eq!(cands[0].total_input_tokens, 100);
+    }
+
+    #[tokio::test]
+    async fn update_turn_metadata_merges_into_existing_object() {
+        let backend = DuckDbBackend::open(":memory:").unwrap();
+        backend.init().await.unwrap();
+        let mut turn = sample_turn(
+            "tA",
+            "sA",
+            wa::ANTHROPIC,
+            vec!["claude"],
+            1_700_000_000_000_000,
+            1500,
+            1,
+            vec!["c1"],
+            TurnStatus::Complete,
+        );
+        // Pre-existing metadata key — must survive the patch.
+        turn.metadata = serde_json::json!({"unrelated": "preserve_me"});
+        backend.write_turns(vec![turn]).await.unwrap();
+
+        let patch = serde_json::json!({
+            "proxy": {
+                "role": "proxy_in",
+                "pair_id": "p-1",
+                "peer_turn_id": "tB",
+            }
+        });
+        backend.update_turn_metadata("tA", patch).await.unwrap();
+
+        let detail = backend.query_turn_by_id("tA").await.unwrap().unwrap();
+        let meta = detail.metadata.expect("metadata json");
+        assert_eq!(meta.get("unrelated"), Some(&serde_json::Value::String("preserve_me".into())));
+        assert_eq!(meta["proxy"]["role"], "proxy_in");
+        assert_eq!(meta["proxy"]["peer_turn_id"], "tB");
+    }
+
+    #[tokio::test]
+    async fn query_turns_hides_proxy_hops_by_default_and_surfaces_them_with_flag() {
+        let backend = DuckDbBackend::open(":memory:").unwrap();
+        backend.init().await.unwrap();
+        let base = 1_700_000_000_000_000_i64;
+        // proxy_in (visible by default) + proxy_out (hidden by default)
+        // + a direct turn (always visible).
+        let mut t_in = sample_turn(
+            "t_in",
+            "s",
+            wa::ANTHROPIC,
+            vec!["claude"],
+            base,
+            1500,
+            1,
+            vec!["c_in"],
+            TurnStatus::Complete,
+        );
+        t_in.metadata = serde_json::json!({
+            "proxy": {"role": "proxy_in", "pair_id": "p1", "peer_turn_id": "t_out"}
+        });
+        let mut t_out = sample_turn(
+            "t_out",
+            "s",
+            wa::ANTHROPIC,
+            vec!["claude"],
+            base + 2_000,
+            1500,
+            1,
+            vec!["c_out"],
+            TurnStatus::Complete,
+        );
+        t_out.metadata = serde_json::json!({
+            "proxy": {"role": "proxy_out", "pair_id": "p1", "peer_turn_id": "t_in"}
+        });
+        let t_direct = sample_turn(
+            "t_direct",
+            "s2",
+            wa::ANTHROPIC,
+            vec!["claude"],
+            base + 10_000_000,
+            1500,
+            1,
+            vec!["c_d"],
+            TurnStatus::Complete,
+        );
+        backend
+            .write_turns(vec![t_in.clone(), t_out.clone(), t_direct.clone()])
+            .await
+            .unwrap();
+
+        // Default — proxy_out must be hidden.
+        let mut q = base_turns_query();
+        q.time_range.start_us = base - 1;
+        q.time_range.end_us = base + 1_000_000_000;
+        q.include_proxy_hops = false;
+        let page = backend.query_turns(&q).await.unwrap();
+        let ids: Vec<String> = page.items.iter().map(|i| i.turn_id.clone()).collect();
+        assert!(ids.contains(&"t_in".to_string()));
+        assert!(ids.contains(&"t_direct".to_string()));
+        assert!(!ids.contains(&"t_out".to_string()), "proxy_out must be hidden by default");
+        assert_eq!(page.total, 2);
+        // proxy_in row carries the role + peer_turn_id fields.
+        let in_item = page.items.iter().find(|i| i.turn_id == "t_in").unwrap();
+        assert_eq!(in_item.proxy_role.as_deref(), Some("proxy_in"));
+        assert_eq!(in_item.proxy_peer_turn_id.as_deref(), Some("t_out"));
+        // Direct row has no proxy fields.
+        let d_item = page.items.iter().find(|i| i.turn_id == "t_direct").unwrap();
+        assert_eq!(d_item.proxy_role, None);
+        assert_eq!(d_item.proxy_peer_turn_id, None);
+
+        // Flag flipped — every row is returned including proxy_out.
+        q.include_proxy_hops = true;
+        let page = backend.query_turns(&q).await.unwrap();
+        let ids: Vec<String> = page.items.iter().map(|i| i.turn_id.clone()).collect();
+        assert!(ids.contains(&"t_out".to_string()));
+        assert_eq!(page.total, 3);
+    }
+
+    #[tokio::test]
+    async fn update_turn_metadata_is_noop_when_turn_absent() {
+        let backend = DuckDbBackend::open(":memory:").unwrap();
+        backend.init().await.unwrap();
+        // No turn written; update must succeed silently.
+        let patch = serde_json::json!({"proxy": {"role": "proxy_in"}});
+        backend
+            .update_turn_metadata("never-existed", patch)
+            .await
+            .expect("noop on missing row");
+    }
 }
diff --git a/server/ts-storage/src/backend.rs b/server/ts-storage/src/backend.rs
index 86bb087..e95612d 100644
--- a/server/ts-storage/src/backend.rs
+++ b/server/ts-storage/src/backend.rs
@@ -2,7 +2,7 @@ use async_trait::async_trait;
 use ts_llm::model::LlmCall;
 use ts_metrics::model::{LlmFinishMetric, LlmMetric};
 use ts_protocol::HttpExchange;
-use ts_turn::AgentTurn;
+use ts_turn::{AgentTurn, PairCandidate};
 
 use crate::query::*;
 use crate::retention::{RetentionPolicy, RetentionReport};
@@ -126,4 +126,40 @@ pub trait StorageBackend: Send + Sync {
     /// Delete rows older than the cutoffs in `policy`. `None` cutoffs are
     /// skipped. Returns per-table / per-granularity row counts.
     async fn apply_retention(&self, policy: RetentionPolicy) -> Result<RetentionReport>;
+
+    // ---- llmproxy pair-detection support ----
+    //
+    // The sweeper polls a sliding window of recently-finalized turns,
+    // skipping those that already carry `metadata.proxy.role`, and runs
+    // `ts_turn::pair_all` over the projection. For each pair it writes a
+    // JSON patch into both turns' `metadata` field.
+
+    /// Return a minimal projection of `agent_turns` rows in
+    /// `[start_us, end_us)` suitable for `ts_turn::pair_all`. Rows whose
+    /// `metadata` already carries `proxy.role` are excluded — once a turn
+    /// is paired we don't want to re-pair it on the next sweep.
+    /// Default: empty (in-memory mock backends used by tests have no
+    /// pairing to surface).
+    async fn query_pair_candidates(
+        &self,
+        _start_us: i64,
+        _end_us: i64,
+    ) -> Result<Vec<PairCandidate>> {
+        Ok(Vec::new())
+    }
+
+    /// Merge `patch` into the existing `metadata` JSON of `turn_id`
+    /// (top-level shallow merge — only keys present in `patch` are
+    /// replaced). Used by the pair sweeper to write `proxy.role` /
+    /// `proxy.pair_id` / `proxy.peer_turn_id` back to both legs.
+    /// Returns `Ok(())` even if `turn_id` doesn't exist — the sweeper
+    /// races finalization and a turn may briefly be unwritten when the
+    /// patch arrives.
+    async fn update_turn_metadata(
+        &self,
+        _turn_id: &str,
+        _patch: serde_json::Value,
+    ) -> Result<()> {
+        Ok(())
+    }
 }
diff --git a/server/ts-storage/src/lib.rs b/server/ts-storage/src/lib.rs
index e462117..4062c4a 100644
--- a/server/ts-storage/src/lib.rs
+++ b/server/ts-storage/src/lib.rs
@@ -1,11 +1,13 @@
 pub mod backend;
 pub mod buffer;
+pub mod pair_sweeper;
 pub mod query;
 pub mod retention;
 pub mod sink;
 
 pub use backend::StorageBackend;
 pub use buffer::WriteBuffer;
+pub use pair_sweeper::{spawn_pair_sweeper, sweep_once, PairSweeperConfig, SweepStats};
 pub use query::*;
 pub use retention::{policy_from_config, spawn_retention_task, RetentionPolicy, RetentionReport};
 pub use sink::{spawn_storage_sink_stage, StorageSinkConfig};
diff --git a/server/ts-storage/src/pair_sweeper.rs b/server/ts-storage/src/pair_sweeper.rs
new file mode 100644
index 0000000..53b6799
--- /dev/null
+++ b/server/ts-storage/src/pair_sweeper.rs
@@ -0,0 +1,416 @@
+//! Background pair-detection sweeper.
+//!
+//! Runs as a long-lived tokio task spawned next to the storage sink.
+//! On each tick it asks the storage backend for a window of finalized
+//! turns whose `metadata.proxy.role` is unset, runs the in-memory
+//! `pair_all` classifier, and writes the resulting pair annotations
+//! back via `update_turn_metadata`. The sweep is fully idempotent: a
+//! turn that is already paired is excluded by the backend query, so
+//! repeat sweeps converge.
+//!
+//! ### Scheduling
+//!
+//! Two clocks drive the sweep:
+//!
+//! * `interval` — how often to wake up.
+//! * `lookback` — how far back to scan on each wake. The window starts
+//!   at `now - lookback` and ends at `now`. Lookback must comfortably
+//!   exceed the worst-case latency between the two legs of a pair
+//!   landing in the DB so we never miss a peer. Tracker grace is 1s by
+//!   default and the storage sink flush interval is ~100ms, so 5
+//!   minutes is generous headroom — keep it well above the slowest
+//!   plausible proxy round-trip and finalization-grace combined.
+//!
+//! ### Why a sweeper (not inline at write-time)
+//!
+//! When `write_turns` flushes a batch, the peer of a pair may not yet
+//! have arrived — it might still be sitting in another shard's buffer
+//! waiting for grace. Inline pairing at write time would systematically
+//! miss the first of any pair. A sweeper that scans recently-finalized
+//! turns naturally absorbs that latency.
+
+use std::sync::Arc;
+use std::time::Duration;
+
+use tokio::task::JoinHandle;
+
+use ts_turn::proxy_pair::group_all;
+
+use crate::StorageBackend;
+
+/// Configuration for the pair sweeper.
+#[derive(Debug, Clone, Copy)]
+pub struct PairSweeperConfig {
+    /// Cadence between sweeps. Default 2s — proxy hops only pair after
+    /// both legs flush, and the user has no expectation of sub-second
+    /// folding on the agent-turn list.
+    pub interval: Duration,
+    /// How far back to scan on each sweep. The query is indexed on
+    /// `start_time`, so a generous lookback is cheap. Default 5 min.
+    pub lookback: Duration,
+}
+
+impl Default for PairSweeperConfig {
+    fn default() -> Self {
+        Self {
+            interval: Duration::from_secs(2),
+            // 30min — wide enough to catch a turn whose peer arrives
+            // anomalously late (slow proxy + slow flush), but short
+            // enough that the sweeper's repeat work per tick stays
+            // bounded. The metadata.proxy.role IS NULL filter on the
+            // query keeps already-paired turns out of every sweep so
+            // there's no fan-out from past pairs.
+            lookback: Duration::from_secs(1800),
+        }
+    }
+}
+
+/// Spawn the sweeper. Runs until `storage` is dropped from every other
+/// holder AND the inner sleep wakes — in practice the task lives for the
+/// process lifetime. Errors during a sweep are logged and the sweeper
+/// continues; one bad sweep should never take down the pipeline.
+pub fn spawn_pair_sweeper(
+    cfg: PairSweeperConfig,
+    storage: Arc<dyn StorageBackend>,
+) -> JoinHandle<()> {
+    tokio::spawn(async move {
+        // Stagger the first sweep so it doesn't fire the same instant as
+        // service start (the DB may still be empty / cold).
+        tokio::time::sleep(cfg.interval).await;
+        loop {
+            if let Err(e) = sweep_once(&storage, cfg.lookback).await {
+                tracing::warn!(error = %e, "pair-sweeper: sweep failed; continuing");
+            }
+            tokio::time::sleep(cfg.interval).await;
+        }
+    })
+}
+
+/// One sweep iteration. Pulled out for testability — callers can drive
+/// the sweeper from synthetic data without spawning a task.
+pub async fn sweep_once(
+    storage: &Arc<dyn StorageBackend>,
+    lookback: Duration,
+) -> ts_common::error::Result<SweepStats> {
+    let now_us = chrono::Utc::now().timestamp_micros();
+    let start_us = now_us - (lookback.as_micros() as i64);
+    let candidates = storage.query_pair_candidates(start_us, now_us).await?;
+    let candidates_scanned = candidates.len();
+    let groups = group_all(&candidates);
+    let groups_assigned = groups.len();
+    let mut turns_tagged = 0usize;
+    for g in groups {
+        for member in &g.members {
+            let patch = g
+                .metadata_for(&member.turn_id)
+                .expect("member belongs to group it came from");
+            storage
+                .update_turn_metadata(&member.turn_id, patch)
+                .await?;
+            turns_tagged += 1;
+        }
+    }
+    Ok(SweepStats {
+        candidates_scanned,
+        pairs_assigned: groups_assigned,
+        turns_tagged,
+    })
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct SweepStats {
+    pub candidates_scanned: usize,
+    /// Number of distinct logical-call groups (each containing 2+
+    /// turns). Reads as "how many duplicates folded".
+    pub pairs_assigned: usize,
+    /// Total per-turn metadata writes (one per group member). Useful
+    /// for distinguishing "1 fat 3-leg group" from "3 mirror pairs"
+    /// in metrics.
+    pub turns_tagged: usize,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use async_trait::async_trait;
+    use std::collections::HashMap;
+    use std::sync::Mutex as StdMutex;
+    use ts_common::error::Result;
+    use ts_llm::model::LlmCall;
+    use ts_metrics::model::{LlmFinishMetric, LlmMetric};
+    use ts_protocol::HttpExchange;
+    use crate::query::*;
+    use crate::retention::{RetentionPolicy, RetentionReport};
+
+    use ts_turn::proxy_pair::PairCandidate;
+    use ts_turn::AgentTurn;
+
+    /// In-memory stub storage that holds the candidates the sweeper will
+    /// see and records the metadata patches it writes back. Lets us test
+    /// the sweeper without a real DB.
+    struct StubStorage {
+        candidates: Vec<PairCandidate>,
+        updates: StdMutex<HashMap<String, serde_json::Value>>,
+    }
+
+    #[async_trait]
+    impl StorageBackend for StubStorage {
+        async fn init(&self) -> Result<()> {
+            Ok(())
+        }
+        async fn write_calls(&self, _: Vec<LlmCall>) -> Result<()> {
+            Ok(())
+        }
+        async fn write_metrics(&self, _: Vec<LlmMetric>) -> Result<()> {
+            Ok(())
+        }
+        async fn write_finish_metrics(&self, _: Vec<LlmFinishMetric>) -> Result<()> {
+            Ok(())
+        }
+        async fn write_turns(&self, _: Vec<AgentTurn>) -> Result<()> {
+            Ok(())
+        }
+        async fn write_exchanges(&self, _: Vec<HttpExchange>) -> Result<()> {
+            Ok(())
+        }
+        async fn query_http_exchange_by_id(
+            &self,
+            _: &str,
+        ) -> Result<Option<HttpExchangeDetail>> {
+            Ok(None)
+        }
+        async fn query_http_exchanges(
+            &self,
+            _: &HttpExchangesQuery,
+        ) -> Result<HttpExchangesPage> {
+            Ok(HttpExchangesPage { total: 0, items: vec![] })
+        }
+        async fn query_metrics_timeseries(
+            &self,
+            _: &MetricsTimeseriesQuery,
+        ) -> Result<Vec<MetricsTimeseriesRow>> {
+            Ok(vec![])
+        }
+        async fn query_metrics_summary(
+            &self,
+            _: &MetricsSummaryQuery,
+        ) -> Result<MetricsSummaryRow> {
+            Ok(MetricsSummaryRow {
+                call_count: 0,
+                error_count: 0,
+                error_4xx_count: 0,
+                error_429_count: 0,
+                error_5xx_count: 0,
+                total_input_tokens: 0,
+                total_output_tokens: 0,
+                ttft_avg: None,
+                e2e_avg: None,
+                tpot_avg: None,
+            })
+        }
+        async fn query_metrics_models(
+            &self,
+            _: &MetricsModelsQuery,
+        ) -> Result<Vec<MetricsModelRow>> {
+            Ok(vec![])
+        }
+        async fn query_finish_reasons(
+            &self,
+            _: &FinishReasonsQuery,
+        ) -> Result<Vec<FinishReasonTimeseries>> {
+            Ok(vec![])
+        }
+        async fn query_calls(&self, _: &CallsQuery) -> Result<CallsPage> {
+            Ok(CallsPage { total: 0, items: vec![] })
+        }
+        async fn query_call_by_id(&self, _: &str) -> Result<Option<CallDetail>> {
+            Ok(None)
+        }
+        async fn query_turns(&self, _: &TurnsQuery) -> Result<TurnsPage> {
+            Ok(TurnsPage { total: 0, items: vec![] })
+        }
+        async fn query_turn_by_id(&self, _: &str) -> Result<Option<TurnDetail>> {
+            Ok(None)
+        }
+        async fn query_turn_calls(
+            &self,
+            _: &str,
+            _include_bodies: bool,
+        ) -> Result<Vec<TurnCallItem>> {
+            Ok(vec![])
+        }
+        async fn query_calls_by_ids(
+            &self,
+            _: &[String],
+            _include_bodies: bool,
+        ) -> Result<Vec<TurnCallItem>> {
+            Ok(vec![])
+        }
+        async fn query_sessions(&self, _: &SessionListQuery) -> Result<SessionsPage> {
+            Ok(SessionsPage { items: vec![], next_cursor: None })
+        }
+        async fn query_session_by_id(
+            &self,
+            _: &str,
+            _: &str,
+        ) -> Result<Option<SessionDetail>> {
+            Ok(None)
+        }
+        async fn query_session_turns(
+            &self,
+            _: &SessionTurnsQuery,
+        ) -> Result<SessionTurnsPage> {
+            Ok(SessionTurnsPage { items: vec![], next_cursor: None })
+        }
+        async fn query_distinct_wire_apis(&self) -> Result<Vec<String>> {
+            Ok(vec![])
+        }
+        async fn query_distinct_models(&self) -> Result<Vec<String>> {
+            Ok(vec![])
+        }
+        async fn query_distinct_server_ips(&self) -> Result<Vec<String>> {
+            Ok(vec![])
+        }
+        async fn query_distinct_agent_kinds(
+            &self,
+            _start_us: i64,
+            _end_us: i64,
+        ) -> Result<Vec<String>> {
+            Ok(vec![])
+        }
+        async fn query_distinct_finish_reasons(&self) -> Result<Vec<DistinctFinishReason>> {
+            Ok(vec![])
+        }
+        async fn apply_retention(&self, _: RetentionPolicy) -> Result<RetentionReport> {
+            Ok(RetentionReport::default())
+        }
+        async fn query_pair_candidates(
+            &self,
+            _: i64,
+            _: i64,
+        ) -> Result<Vec<PairCandidate>> {
+            Ok(self.candidates.clone())
+        }
+        async fn update_turn_metadata(
+            &self,
+            turn_id: &str,
+            patch: serde_json::Value,
+        ) -> Result<()> {
+            self.updates.lock().unwrap().insert(turn_id.into(), patch);
+            Ok(())
+        }
+    }
+
+    fn cand(id: &str, sid: &str, start: i64, end: i64, view: &str) -> PairCandidate {
+        PairCandidate {
+            turn_id: id.into(),
+            session_id: sid.into(),
+            agent_kind: "openclaw".into(),
+            wire_api: "openai-chat".into(),
+            start_time_us: start,
+            end_time_us: end,
+            call_count: 1,
+            total_input_tokens: 100,
+            total_output_tokens: 10,
+            final_finish_reason: Some("stop".into()),
+            primary_model: Some("GLM-5.1".into()),
+            network_view: view.into(),
+        }
+    }
+
+    #[tokio::test]
+    async fn sweep_once_writes_metadata_for_matched_pair() {
+        // Real-data shape: outer leg encloses inner, network views differ.
+        let stub = Arc::new(StubStorage {
+            candidates: vec![
+                cand("outer", "S", 100_000, 200_000, "client->host"),
+                cand("inner", "S", 102_000, 199_000, "bridge->upstream"),
+            ],
+            updates: StdMutex::new(HashMap::new()),
+        }) as Arc<dyn StorageBackend>;
+        let stats = sweep_once(&stub, Duration::from_secs(60)).await.unwrap();
+        assert_eq!(stats.pairs_assigned, 1);
+        assert_eq!(stats.candidates_scanned, 2);
+
+        // The second test verifies the actual patch contents written
+        // through the stub. Here we just assert pair detection ran end
+        // to end — the sweeper only counts a pair after BOTH
+        // update_turn_metadata calls succeeded.
+    }
+
+    #[tokio::test]
+    async fn sweep_once_assigns_proxy_in_to_outer_leg() {
+        // Recreate the verified wuneng haproxy_glm5 pair shape and
+        // check the proxy_in role lands on the outer leg.
+        let stub_inner = Arc::new(StubStorage {
+            candidates: vec![
+                cand("outer", "S", 348_294_000, 350_588_000, "client->host"),
+                cand("inner", "S", 348_296_000, 350_587_000, "bridge->upstream"),
+            ],
+            updates: StdMutex::new(HashMap::new()),
+        });
+        let stub = stub_inner.clone() as Arc<dyn StorageBackend>;
+        let stats = sweep_once(&stub, Duration::from_secs(3600)).await.unwrap();
+        assert_eq!(stats.pairs_assigned, 1);
+        assert_eq!(stats.turns_tagged, 2);
+        let updates = stub_inner.updates.lock().unwrap();
+        let outer_patch = updates.get("outer").expect("outer patched");
+        let inner_patch = updates.get("inner").expect("inner patched");
+        assert_eq!(outer_patch["proxy"]["role"], "proxy_in");
+        assert_eq!(inner_patch["proxy"]["role"], "proxy_out");
+        // pair_id is shared between members of the same group.
+        assert_eq!(outer_patch["proxy"]["pair_id"], inner_patch["proxy"]["pair_id"]);
+        // peer_turn_ids cross-references (legacy peer_turn_id matches first peer).
+        assert_eq!(outer_patch["proxy"]["peer_turn_id"], "inner");
+        assert_eq!(inner_patch["proxy"]["peer_turn_id"], "outer");
+        // peer_turn_ids is an array with the right peer for each member.
+        assert_eq!(outer_patch["proxy"]["peer_turn_ids"], serde_json::json!(["inner"]));
+        assert_eq!(inner_patch["proxy"]["peer_turn_ids"], serde_json::json!(["outer"]));
+    }
+
+    #[tokio::test]
+    async fn sweep_once_folds_three_leg_haproxy_topology() {
+        // The user's actual production scenario: br0 + docker0 mirror
+        // pair PLUS the real upstream forward leg, all under the same
+        // session. All three must wind up in one group so the default
+        // list shows ONE row.
+        let stub_inner = Arc::new(StubStorage {
+            candidates: vec![
+                cand("a_br0", "S", 1_000_000, 3_000_000, "172.16.103.100->172.16.103.81"),
+                cand("b_dock0", "S", 1_000_000, 3_000_000, "172.16.103.100->172.17.0.9"),
+                cand("c_hop", "S", 1_002_000, 2_999_000, "172.17.0.1->172.17.0.4"),
+            ],
+            updates: StdMutex::new(HashMap::new()),
+        });
+        let stub = stub_inner.clone() as Arc<dyn StorageBackend>;
+        let stats = sweep_once(&stub, Duration::from_secs(3600)).await.unwrap();
+        assert_eq!(stats.pairs_assigned, 1, "all three legs are one logical call");
+        assert_eq!(stats.turns_tagged, 3);
+        let updates = stub_inner.updates.lock().unwrap();
+        let a = updates.get("a_br0").expect("a_br0 patched");
+        let b = updates.get("b_dock0").expect("b_dock0 patched");
+        let c = updates.get("c_hop").expect("c_hop patched");
+        // Canonical (widest span, lex tiebreak) is a_br0.
+        assert_eq!(a["proxy"]["role"], "proxy_in");
+        assert_eq!(b["proxy"]["role"], "mirror_secondary");
+        assert_eq!(c["proxy"]["role"], "proxy_out");
+        // All three share the same group/pair id.
+        assert_eq!(a["proxy"]["pair_id"], b["proxy"]["pair_id"]);
+        assert_eq!(a["proxy"]["pair_id"], c["proxy"]["pair_id"]);
+        // Peer lists exclude self and are sorted lex.
+        assert_eq!(a["proxy"]["peer_turn_ids"], serde_json::json!(["b_dock0", "c_hop"]));
+        assert_eq!(b["proxy"]["peer_turn_ids"], serde_json::json!(["a_br0", "c_hop"]));
+        assert_eq!(c["proxy"]["peer_turn_ids"], serde_json::json!(["a_br0", "b_dock0"]));
+    }
+
+    #[tokio::test]
+    async fn sweep_once_skips_lone_turns() {
+        let stub = Arc::new(StubStorage {
+            candidates: vec![cand("solo", "S", 0, 1000, "v")],
+            updates: StdMutex::new(HashMap::new()),
+        }) as Arc<dyn StorageBackend>;
+        let stats = sweep_once(&stub, Duration::from_secs(60)).await.unwrap();
+        assert_eq!(stats.pairs_assigned, 0);
+        assert_eq!(stats.candidates_scanned, 1);
+    }
+}
diff --git a/server/ts-storage/src/query.rs b/server/ts-storage/src/query.rs
index 0d583fe..a230a55 100644
--- a/server/ts-storage/src/query.rs
+++ b/server/ts-storage/src/query.rs
@@ -219,6 +219,12 @@ pub struct TurnsQuery {
     pub sort_order: String,
     pub page: u32,
     pub page_size: u32,
+    /// When `false` (default), hide turns the pair sweeper has marked as
+    /// `proxy_out` or `mirror_secondary`. The folded leg is still
+    /// reachable by `turn_id` lookup. When `true`, return every row,
+    /// useful for diagnostics or for users who want to see the raw
+    /// captured topology.
+    pub include_proxy_hops: bool,
 }
 
 #[derive(Debug, Clone, Serialize)]
@@ -242,6 +248,25 @@ pub struct TurnListItem {
     pub final_finish_reason: Option<String>,
     pub user_input_preview: Option<String>,
     pub final_answer_preview: Option<String>,
+    /// `"proxy_in"` / `"proxy_out"` / `"mirror_primary"` /
+    /// `"mirror_secondary"` when the pair sweeper has classified this
+    /// turn. Absent on direct (un-proxied) turns and on turns the
+    /// sweeper hasn't reached yet.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub proxy_role: Option<String>,
+    /// `turn_id` of the matched peer leg, for navigation. Absent when
+    /// `proxy_role` is absent. For groups of >2 turns (the haproxy
+    /// 3-leg case) this surfaces only the first peer for backward
+    /// compatibility — clients should read `proxy_peer_turn_ids` to
+    /// see the full set.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub proxy_peer_turn_id: Option<String>,
+    /// Every other member of this turn's proxy group (excludes self),
+    /// sorted lex. Empty/absent on direct turns. Two-member groups
+    /// have one entry here; three-member groups (haproxy_glm5: host
+    /// view + docker view + upstream hop) have two.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub proxy_peer_turn_ids: Option<Vec<String>>,
 }
 
 #[derive(Debug, Clone, Serialize)]
@@ -566,6 +591,104 @@ pub struct SessionTurnsQuery {
     pub page_size: u32,
 }
 
+// ---- Proxy view (multi-leg fold) ----
+
+/// Per-leg snapshot returned in a `ProxyViewResponse`. Each row is one
+/// captured vantage point of the same logical call. The list is ordered
+/// canonical-first (proxy_in / mirror_primary), then the hops.
+#[derive(Debug, Clone, Serialize)]
+pub struct ProxyViewMember {
+    pub turn_id: String,
+    pub role: String,
+    pub client_ip: String,
+    pub client_port: Option<u16>,
+    pub server_ip: String,
+    pub server_port: Option<u16>,
+    pub start_time: i64,
+    pub end_time: i64,
+    pub duration_ms: u64,
+    pub ttft_ms: Option<f64>,
+    pub e2e_latency_ms: Option<f64>,
+    pub request_model: Option<String>,
+    pub wire_api: String,
+    pub request_path: Option<String>,
+    pub status_code: Option<u16>,
+    /// Parsed request headers as `Vec<(name, value)>`. Empty when the
+    /// leg's first call had no captured request_headers blob.
+    pub request_headers: Vec<(String, String)>,
+    pub response_headers: Vec<(String, String)>,
+}
+
+/// One header line in the multi-leg diff. The same `name` may appear in
+/// multiple entries if the proxy adds *and* removes the same header
+/// across legs (the leg dimension is captured via `values[i].turn_id`).
+#[derive(Debug, Clone, Serialize)]
+pub struct HeaderDiffEntry {
+    pub name: String,
+    pub kind: HeaderDiffKind,
+    pub values: Vec<HeaderValueByLeg>,
+}
+
+#[derive(Debug, Clone, Copy, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum HeaderDiffKind {
+    /// Same `(name, value)` in every member of the group. UI dims these.
+    Common,
+    /// All members have the header but with different values — the
+    /// proxy rewrote it. Classic example: `Host`.
+    Modified,
+    /// Only some members have the header. The non-listed members
+    /// stripped or never carried it. Classic example:
+    /// `x-litellm-call-id` (added by proxy_in side only) or
+    /// `anthropic-request-id` (returned only by the upstream provider).
+    PerLeg,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct HeaderValueByLeg {
+    pub turn_id: String,
+    pub role: String,
+    pub value: String,
+}
+
+/// Optional model-name rewrite the proxy applied. `None` when every
+/// leg's request body had the same `model` field (or none of them did).
+#[derive(Debug, Clone, Serialize)]
+pub struct ModelRewrite {
+    /// Model name the client *sent*. Taken from the canonical leg's
+    /// (proxy_in / mirror_primary) request body.
+    pub client_requested: Option<String>,
+    /// Model name the upstream provider *received*. Taken from the
+    /// proxy_out leg's request body.
+    pub upstream_received: Option<String>,
+}
+
+/// Latency breakdown across legs. `proxy_overhead_ms` is the difference
+/// between the client-facing leg's e2e and the upstream-facing leg's
+/// e2e — what the proxy itself spent dispatching / serializing /
+/// running its callbacks.
+#[derive(Debug, Clone, Serialize)]
+pub struct LatencyBreakdown {
+    pub client_observed_ms: Option<f64>,
+    pub upstream_observed_ms: Option<f64>,
+    pub proxy_overhead_ms: Option<f64>,
+}
+
+/// Response from `GET /api/agent-turns/{id}/proxy-view`. Aggregates the
+/// requested turn plus every peer in its `metadata.proxy.peer_turn_ids`
+/// group, then produces a header diff and latency breakdown.
+#[derive(Debug, Clone, Serialize)]
+pub struct ProxyViewResponse {
+    /// `metadata.proxy.pair_id` shared by every member.
+    pub group_id: String,
+    pub members: Vec<ProxyViewMember>,
+    pub request_header_diff: Vec<HeaderDiffEntry>,
+    pub response_header_diff: Vec<HeaderDiffEntry>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model_rewrite: Option<ModelRewrite>,
+    pub latency_breakdown: LatencyBreakdown,
+}
+
 #[derive(Debug, Clone, Serialize)]
 pub struct CallDetail {
     pub id: String,
diff --git a/server/ts-turn/src/lib.rs b/server/ts-turn/src/lib.rs
index 2f999a3..ff37b5f 100644
--- a/server/ts-turn/src/lib.rs
+++ b/server/ts-turn/src/lib.rs
@@ -4,9 +4,14 @@
 //! participate in turn grouping.
 
 pub mod model;
+pub mod proxy_pair;
 pub mod stage;
 pub mod tracker;
 
 pub use model::{new_active_turn_registry, ActiveTurnRegistry, AgentTurn, TurnKey, TurnStatus};
+pub use proxy_pair::{
+    candidate_from_turn, group_all, GroupMember, PairCandidate, ProxyGroup, ProxyRole,
+    MAX_REQ_TIME_GAP_US, MIRROR_TIME_TOLERANCE_US,
+};
 pub use stage::spawn_turn_stage;
 pub use tracker::{TurnEvent, TurnTracker};
diff --git a/server/ts-turn/src/proxy_pair.rs b/server/ts-turn/src/proxy_pair.rs
new file mode 100644
index 0000000..fc7e956
--- /dev/null
+++ b/server/ts-turn/src/proxy_pair.rs
@@ -0,0 +1,585 @@
+//! Passive llmproxy pair detection — folds 2+ `AgentTurn` records that
+//! represent the same logical LLM call observed at different network
+//! vantage points.
+//!
+//! Three (or more) scenarios produce duplicate turns in TokenScope:
+//!
+//! 1. **Real proxy hops** — e.g. an external client → haproxy_glm5 container
+//!    → sglang container. Both legs cross interfaces TokenScope captures
+//!    so each becomes its own `AgentTurn`. The proxy_in leg strictly
+//!    contains the proxy_out leg in event time.
+//!
+//! 2. **Multi-interface double-capture** — libpcap on `any` interface
+//!    captures the *same* packet once on `br0` (host-IP view) and once
+//!    on `docker0` (container-IP view). Near-identical timestamps,
+//!    distinct `(client_ip, server_ip)` 5-tuples.
+//!
+//! 3. **Both at once (the haproxy_glm5 case)** — three legs per call:
+//!    a host-IP view of the inbound + a docker-IP view of the same
+//!    inbound (mirror pair) + the proxy's outbound hop to the real
+//!    upstream (strictly nested inside the mirror pair). All three
+//!    represent the same logical request and should fold into one row.
+//!
+//! ### Why N-member groups instead of pairs
+//!
+//! The original 2-member pair algorithm could not collapse the
+//! haproxy_glm5 case — given {A, B, C} where (A, B) are mirrors and C
+//! is nested inside both, the greedy "closest peer" rule paired the
+//! 0ms mirror first and left C with no available peer. We model the
+//! result as a **group** of arbitrary size; every member shares the
+//! same `group_id` and points at every other peer via `peer_turn_ids`.
+//!
+//! ### Why not topology (A.server_ip == B.client_ip)
+//!
+//! Docker bridges SNAT outbound traffic from a container's IP to the
+//! bridge gateway IP (172.17.0.1 instead of the originating container's
+//! 172.17.0.9). The proxy host's *listen* IP and its *outbound* IP differ
+//! on captured packets, so the obvious topological signal is unreliable.
+//! Content + timing is the rule that survives.
+
+use std::collections::HashMap;
+
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+use crate::model::AgentTurn;
+
+/// Role of a turn inside its group.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ProxyRole {
+    /// Outer leg — the client-facing entry into the proxy. Strict event-
+    /// time nesting: `proxy_in.start ≤ other.start` and
+    /// `proxy_in.end ≥ other.end`. Visible in the default list view.
+    /// When a group contains both nested members and mirrors, the
+    /// canonical leg takes `ProxyIn` (the more informative role).
+    ProxyIn,
+    /// Inner leg — the proxy's outbound call to the real upstream. Hidden
+    /// from the default list view.
+    ProxyOut,
+    /// Same packet captured twice on different interfaces. Times overlap
+    /// within `MIRROR_TIME_TOLERANCE_US` on both ends with the canonical.
+    /// Used when no nested member exists; otherwise the canonical
+    /// upgrades to `ProxyIn` and mirror members downgrade to
+    /// `MirrorSecondary`.
+    MirrorPrimary,
+    /// Hidden mirror copy of the canonical.
+    MirrorSecondary,
+}
+
+impl ProxyRole {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            ProxyRole::ProxyIn => "proxy_in",
+            ProxyRole::ProxyOut => "proxy_out",
+            ProxyRole::MirrorPrimary => "mirror_primary",
+            ProxyRole::MirrorSecondary => "mirror_secondary",
+        }
+    }
+
+    /// Whether the API list view should hide this role by default.
+    /// `proxy_in` and `mirror_primary` stay visible (one row per
+    /// logical call); the rest fold under them.
+    pub fn hidden_by_default(self) -> bool {
+        matches!(self, ProxyRole::ProxyOut | ProxyRole::MirrorSecondary)
+    }
+}
+
+/// Maximum gap between any two members' start_times for them to be
+/// considered the same logical call. Live data shows real proxy hops at
+/// 2ms and mirror duplicates at <1ms; 100ms gives generous headroom for
+/// slower proxies (LiteLLM forwarding to a remote upstream).
+pub const MAX_REQ_TIME_GAP_US: i64 = 100_000;
+
+/// For mirror classification: both start_time and end_time must agree
+/// within this tolerance. Same-packet double-capture on different
+/// interfaces sees identical kernel timestamps modulo libpcap dispatch
+/// jitter (<100us in practice). Real proxy hops — even the cheapest
+/// in-container ones — introduce at least 1ms of forwarding overhead, so
+/// 500us cleanly separates the two cases. Don't widen this without
+/// re-checking that the verified haproxy_glm5 turn pair from wuneng
+/// (start_gap 2ms, end_gap 1ms) still classifies as strict-nesting.
+pub const MIRROR_TIME_TOLERANCE_US: i64 = 500;
+
+/// Light fingerprint of an `AgentTurn` carrying just the fields the
+/// pairing rule needs. Pulled from DB via a narrow projection so the
+/// sweeper doesn't materialize every column.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct PairCandidate {
+    pub turn_id: String,
+    pub session_id: String,
+    pub agent_kind: String,
+    pub wire_api: String,
+    pub start_time_us: i64,
+    pub end_time_us: i64,
+    pub call_count: u32,
+    pub total_input_tokens: u64,
+    pub total_output_tokens: u64,
+    pub final_finish_reason: Option<String>,
+    pub primary_model: Option<String>,
+    /// Stable string form of `(client_ip, server_ip)` used to ensure
+    /// group members observed the call from different vantage points.
+    /// Server port is intentionally excluded — different proxy hops differ
+    /// only on server port in some topologies, and including it doesn't
+    /// add discriminating power.
+    pub network_view: String,
+}
+
+/// A cluster of 2+ turns that represent the same logical LLM call.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ProxyGroup {
+    pub group_id: String,
+    pub members: Vec<GroupMember>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct GroupMember {
+    pub turn_id: String,
+    pub role: ProxyRole,
+}
+
+impl ProxyGroup {
+    fn new(members: Vec<GroupMember>) -> Self {
+        Self {
+            group_id: format!("group-{}", Uuid::now_v7()),
+            members,
+        }
+    }
+
+    /// JSON value to merge into `turn_id`'s `metadata` field. Includes
+    /// `peer_turn_ids` (every other member's turn_id, sorted lex) and
+    /// the legacy `peer_turn_id` (the first peer in that list, for
+    /// pre-multi-leg API consumers).
+    pub fn metadata_for(&self, turn_id: &str) -> Option<serde_json::Value> {
+        let me = self.members.iter().find(|m| m.turn_id == turn_id)?;
+        let mut peers: Vec<String> = self
+            .members
+            .iter()
+            .filter(|m| m.turn_id != turn_id)
+            .map(|m| m.turn_id.clone())
+            .collect();
+        peers.sort();
+        let first_peer = peers.first().cloned();
+        Some(serde_json::json!({
+            "proxy": {
+                "role": me.role.as_str(),
+                // We keep the field name `pair_id` instead of `group_id`
+                // so already-shipped consumers and stored metadata stay
+                // valid. It's an opaque identifier — the rename would
+                // only be cosmetic.
+                "pair_id": self.group_id,
+                "peer_turn_ids": peers,
+                // Legacy single-peer pointer kept for backward
+                // compatibility — older API clients only know about the
+                // 2-member case. Returns the lex-first peer when the
+                // group has multiple peers.
+                "peer_turn_id": first_peer,
+            }
+        }))
+    }
+}
+
+/// Content fingerprint (everything that must agree across all members
+/// of a group) — used to bucket candidates before time-clustering.
+///
+/// Intentionally NOT in the fingerprint (all observed in live wuneng
+/// data, mirrors the same exclusions in the front-end call-level
+/// `lib/call-pair.ts::contentKey`):
+///
+/// * `wire_api` — LiteLLM and similar proxies translate API styles
+///   across the boundary (client Anthropic → upstream OpenAI etc.).
+/// * `final_finish_reason` — translates alongside the API style
+///   (`end_turn` ↔ `stop`, `tool_use` ↔ `tool_calls`, `max_tokens` ↔
+///   `length`).
+/// * `primary_model` — LiteLLM advertises a model alias on the client
+///   side (e.g. `glm5`) and rewrites it to the upstream's canonical
+///   name (`GLM-5.1`) before forwarding. Surfaced in Proxy view, not
+///   pairing-key material.
+///
+/// `session_id` is the strongest signal — agent profiles already
+/// content-hash on first user message, so cross-proxy legs land in
+/// the same session by construction. `agent_kind` and `call_count`
+/// co-vary with the session derivation and stay in the key as
+/// inexpensive sanity-checks. Tokens are passed through unchanged by
+/// well-behaved proxies and are the API-format-invariant content
+/// signal.
+fn content_fingerprint(
+    c: &PairCandidate,
+) -> (&str, &str, u32, u64, u64) {
+    (
+        c.session_id.as_str(),
+        c.agent_kind.as_str(),
+        c.call_count,
+        c.total_input_tokens,
+        c.total_output_tokens,
+    )
+}
+
+/// Within a content-fingerprint-equal bucket, walk in start_time order
+/// and grow a cluster as long as the next turn falls within
+/// `MAX_REQ_TIME_GAP_US` of the *latest* member's start_time. A new
+/// cluster opens as soon as the gap is exceeded.
+fn time_clusters(mut idxs: Vec<usize>, set: &[PairCandidate]) -> Vec<Vec<usize>> {
+    idxs.sort_by_key(|&i| set[i].start_time_us);
+    let mut out: Vec<Vec<usize>> = Vec::new();
+    for i in idxs {
+        let pushed = if let Some(cluster) = out.last() {
+            let last_start = set[*cluster.last().unwrap()].start_time_us;
+            set[i].start_time_us - last_start <= MAX_REQ_TIME_GAP_US
+        } else {
+            false
+        };
+        if pushed {
+            out.last_mut().unwrap().push(i);
+        } else {
+            out.push(vec![i]);
+        }
+    }
+    out
+}
+
+/// Pick the canonical member of a cluster: the leg with the widest time
+/// span (smallest start_time, largest end_time). When two legs tie on
+/// span (true mirrors), the lexicographically smallest `turn_id` wins
+/// — purely deterministic so re-sweeps yield the same result.
+fn pick_canonical(cluster: &[usize], set: &[PairCandidate]) -> usize {
+    cluster
+        .iter()
+        .copied()
+        .min_by(|&a, &b| {
+            let ca = &set[a];
+            let cb = &set[b];
+            // Widest span first. start_time ASC, then end_time DESC,
+            // then turn_id ASC as tiebreaker.
+            ca.start_time_us
+                .cmp(&cb.start_time_us)
+                .then_with(|| cb.end_time_us.cmp(&ca.end_time_us))
+                .then_with(|| ca.turn_id.cmp(&cb.turn_id))
+        })
+        .expect("non-empty cluster")
+}
+
+/// Assign per-member roles relative to `canonical_idx`. Returns the
+/// canonical's role too — `ProxyIn` if any non-canonical was classified
+/// `ProxyOut`, else `MirrorPrimary`. Members whose time relationship
+/// with the canonical is neither mirror-overlap nor strict-nesting are
+/// returned as `None` — the caller drops them from the group (they
+/// stay unpaired).
+fn assign_roles(
+    cluster: &[usize],
+    canonical_idx: usize,
+    set: &[PairCandidate],
+) -> Vec<(usize, Option<ProxyRole>)> {
+    let canon = &set[canonical_idx];
+    cluster
+        .iter()
+        .copied()
+        .map(|i| {
+            if i == canonical_idx {
+                return (i, None); // Filled in below by caller
+            }
+            let c = &set[i];
+            if c.network_view == canon.network_view {
+                // Same vantage on both — not a duplicate, drop from group.
+                return (i, None);
+            }
+            let start_gap = (c.start_time_us - canon.start_time_us).abs();
+            let end_gap = (c.end_time_us - canon.end_time_us).abs();
+            if start_gap <= MIRROR_TIME_TOLERANCE_US && end_gap <= MIRROR_TIME_TOLERANCE_US {
+                (i, Some(ProxyRole::MirrorSecondary))
+            } else if canon.start_time_us <= c.start_time_us && canon.end_time_us >= c.end_time_us
+            {
+                (i, Some(ProxyRole::ProxyOut))
+            } else {
+                (i, None) // ambiguous time relationship
+            }
+        })
+        .collect()
+}
+
+/// Group every candidate in `set` into maximal duplicate clusters.
+/// A candidate that doesn't fit any cluster (no peer found) is simply
+/// omitted from the returned list — absence of `metadata.proxy` is the
+/// signal for "direct, non-duplicate turn".
+pub fn group_all(set: &[PairCandidate]) -> Vec<ProxyGroup> {
+    let mut by_fp: HashMap<(&str, &str, u32, u64, u64), Vec<usize>> = HashMap::new();
+    for (i, c) in set.iter().enumerate() {
+        by_fp.entry(content_fingerprint(c)).or_default().push(i);
+    }
+
+    let mut groups = Vec::new();
+    for (_, ids) in by_fp {
+        if ids.len() < 2 {
+            continue;
+        }
+        for cluster in time_clusters(ids, set) {
+            if cluster.len() < 2 {
+                continue;
+            }
+            let canonical_idx = pick_canonical(&cluster, set);
+            let assignments = assign_roles(&cluster, canonical_idx, set);
+            // Drop ambiguous members.
+            let valid_non_canon: Vec<(usize, ProxyRole)> = assignments
+                .iter()
+                .filter_map(|(i, r)| {
+                    if *i == canonical_idx {
+                        None
+                    } else {
+                        r.map(|role| (*i, role))
+                    }
+                })
+                .collect();
+            if valid_non_canon.is_empty() {
+                continue;
+            }
+            // Canonical's role: ProxyIn if any peer is a real hop,
+            // else MirrorPrimary.
+            let canonical_role = if valid_non_canon
+                .iter()
+                .any(|(_, r)| *r == ProxyRole::ProxyOut)
+            {
+                ProxyRole::ProxyIn
+            } else {
+                ProxyRole::MirrorPrimary
+            };
+            let mut members: Vec<GroupMember> = Vec::with_capacity(valid_non_canon.len() + 1);
+            members.push(GroupMember {
+                turn_id: set[canonical_idx].turn_id.clone(),
+                role: canonical_role,
+            });
+            for (i, role) in valid_non_canon {
+                members.push(GroupMember {
+                    turn_id: set[i].turn_id.clone(),
+                    role,
+                });
+            }
+            groups.push(ProxyGroup::new(members));
+        }
+    }
+    groups
+}
+
+/// Build a `PairCandidate` from an `AgentTurn`, used by callers that have
+/// the full turn in memory (e.g. unit tests). Production callers build
+/// candidates directly from a DB projection.
+pub fn candidate_from_turn(t: &AgentTurn) -> PairCandidate {
+    PairCandidate {
+        turn_id: t.turn_id.clone(),
+        session_id: t.session_id.clone(),
+        agent_kind: t.agent_kind.clone(),
+        wire_api: t.wire_api.clone(),
+        start_time_us: t.start_time_us,
+        end_time_us: t.end_time_us,
+        call_count: t.call_count,
+        total_input_tokens: t.total_input_tokens,
+        total_output_tokens: t.total_output_tokens,
+        final_finish_reason: t.final_finish_reason.clone(),
+        primary_model: t.models_used.first().cloned(),
+        network_view: format!("{}->{}", t.client_ip, t.server_ip),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn mk(
+        turn_id: &str,
+        session: &str,
+        start_us: i64,
+        end_us: i64,
+        net_view: &str,
+    ) -> PairCandidate {
+        PairCandidate {
+            turn_id: turn_id.into(),
+            session_id: session.into(),
+            agent_kind: "openclaw".into(),
+            wire_api: "openai-chat".into(),
+            start_time_us: start_us,
+            end_time_us: end_us,
+            call_count: 1,
+            total_input_tokens: 11345,
+            total_output_tokens: 128,
+            final_finish_reason: Some("stop".into()),
+            primary_model: Some("GLM-5.1".into()),
+            network_view: net_view.into(),
+        }
+    }
+
+    fn role_of(g: &ProxyGroup, turn_id: &str) -> Option<ProxyRole> {
+        g.members.iter().find(|m| m.turn_id == turn_id).map(|m| m.role)
+    }
+
+    #[test]
+    fn proxy_hop_strict_nesting_yields_two_member_group() {
+        // Mirrors the verified haproxy_glm5 pair from wuneng: outer
+        // proxy_in starts 2us earlier and ends 1us later than the
+        // inner upstream call.
+        let outer = mk("d3d6", "S", 348_294_000, 350_588_000, "172.16.103.100->172.17.0.9");
+        let inner = mk("d3ec", "S", 348_296_000, 350_587_000, "172.17.0.1->172.17.0.4");
+        let groups = group_all(&[outer, inner]);
+        assert_eq!(groups.len(), 1);
+        let g = &groups[0];
+        assert_eq!(g.members.len(), 2);
+        assert_eq!(role_of(g, "d3d6"), Some(ProxyRole::ProxyIn));
+        assert_eq!(role_of(g, "d3ec"), Some(ProxyRole::ProxyOut));
+    }
+
+    #[test]
+    fn mirror_pair_collapses_when_times_agree_on_both_ends() {
+        // Same packet captured on br0 and docker0 — <500us apart on
+        // both ends.
+        let a = mk("aaaa", "S", 100_000, 200_000, "C->host_ip");
+        let b = mk("bbbb", "S", 100_200, 200_200, "C->container_ip");
+        let groups = group_all(&[a, b]);
+        assert_eq!(groups.len(), 1);
+        assert_eq!(role_of(&groups[0], "aaaa"), Some(ProxyRole::MirrorPrimary));
+        assert_eq!(role_of(&groups[0], "bbbb"), Some(ProxyRole::MirrorSecondary));
+    }
+
+    #[test]
+    fn haproxy_three_leg_collapses_into_single_group() {
+        // The real-world scenario the user is asking for. Three legs
+        // per logical call:
+        //   A — host-IP view of inbound (br0)
+        //   B — docker-IP view of the same inbound (mirror of A)
+        //   C — haproxy's outbound to upstream container (real hop,
+        //       nested inside the mirror pair)
+        let a = mk("a_br0", "S", 1_000_000, 3_000_000, "172.16.103.100->172.16.103.81");
+        let b = mk("b_dock0", "S", 1_000_000, 3_000_000, "172.16.103.100->172.17.0.9");
+        let c = mk("c_hop", "S", 1_002_000, 2_999_000, "172.17.0.1->172.17.0.4");
+        let groups = group_all(&[a, b, c]);
+        assert_eq!(groups.len(), 1, "all three must fold into one group");
+        let g = &groups[0];
+        assert_eq!(g.members.len(), 3);
+        // Canonical has the wider time span. a_br0 and b_dock0 tie on
+        // span; lex-smallest turn_id wins → "a_br0".
+        let canon_role = role_of(g, "a_br0").unwrap();
+        assert_eq!(canon_role, ProxyRole::ProxyIn);
+        // b_dock0 is the mirror of canonical
+        assert_eq!(role_of(g, "b_dock0"), Some(ProxyRole::MirrorSecondary));
+        // c_hop is the real upstream hop
+        assert_eq!(role_of(g, "c_hop"), Some(ProxyRole::ProxyOut));
+        // metadata_for builds the right view for each member
+        let meta_canon = g.metadata_for("a_br0").unwrap();
+        let peers: Vec<&str> = meta_canon["proxy"]["peer_turn_ids"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .map(|v| v.as_str().unwrap())
+            .collect();
+        assert_eq!(peers, vec!["b_dock0", "c_hop"]);
+        // Legacy peer_turn_id field still set to the first peer
+        assert_eq!(meta_canon["proxy"]["peer_turn_id"], "b_dock0");
+    }
+
+    #[test]
+    fn does_not_pair_across_sessions() {
+        let a = mk("a", "session_one", 100, 200, "v1");
+        let b = mk("b", "session_two", 100, 200, "v2");
+        assert!(group_all(&[a, b]).is_empty());
+    }
+
+    #[test]
+    fn does_not_pair_same_network_view() {
+        // Two unrelated calls from the same client/server pair within
+        // 100ms — coincidence, not a duplicate.
+        let a = mk("a", "S", 100, 200, "C->S");
+        let b = mk("b", "S", 150, 250, "C->S");
+        assert!(group_all(&[a, b]).is_empty());
+    }
+
+    #[test]
+    fn does_not_pair_when_time_gap_exceeds_window() {
+        let a = mk("a", "S", 0, 1_000_000, "v1");
+        // Start gap 200ms — well past MAX_REQ_TIME_GAP_US.
+        let b = mk("b", "S", 200_000, 1_200_000, "v2");
+        assert!(group_all(&[a, b]).is_empty());
+    }
+
+    #[test]
+    fn does_not_pair_when_tokens_differ() {
+        let a = mk("a", "S", 0, 1_000, "v1");
+        let mut b = mk("b", "S", 50, 1_050, "v2");
+        b.total_input_tokens = 11344;
+        assert!(group_all(&[a, b]).is_empty());
+    }
+
+    #[test]
+    fn ambiguous_member_dropped_keeps_remaining_group() {
+        // A + B is a valid pair. C has the same content fingerprint
+        // and falls in the time window but its time relationship with
+        // the canonical isn't nesting or mirror (overlapping but
+        // neither contains the other). C is dropped; A+B still pair.
+        let a = mk("a", "S", 0, 2_000_000, "v1");
+        let b = mk("b", "S", 0, 2_000_000, "v2"); // mirror of a
+        let c = mk("c", "S", 1_000_000, 3_000_000, "v3"); // overlap but no nesting w/ canon
+        let groups = group_all(&[a, b, c]);
+        // Group has only A and B; C is ambiguous (start in canonical's
+        // span but end outside it) and gets dropped.
+        assert_eq!(groups.len(), 1);
+        let g = &groups[0];
+        assert_eq!(g.members.len(), 2);
+        let ids: Vec<&str> = g.members.iter().map(|m| m.turn_id.as_str()).collect();
+        assert!(ids.contains(&"a"));
+        assert!(ids.contains(&"b"));
+        assert!(!ids.contains(&"c"));
+    }
+
+    #[test]
+    fn pair_all_handles_two_independent_groups_in_one_session() {
+        // Two distinct logical calls in the same session — both should
+        // be paired independently. Distinct tokens makes them distinct
+        // fingerprints so they cluster apart even without the time
+        // window check.
+        let mut a1 = mk("a1", "S", 1_000, 5_000, "front->host");
+        let mut a2 = mk("a2", "S", 1_500, 4_500, "bridge->upstream");
+        let mut b1 = mk("b1", "S", 10_000, 15_000, "front->host");
+        let mut b2 = mk("b2", "S", 10_500, 14_500, "bridge->upstream");
+        // Different token counts so the two pairs don't merge.
+        a1.total_input_tokens = 100;
+        a2.total_input_tokens = 100;
+        b1.total_input_tokens = 200;
+        b2.total_input_tokens = 200;
+        let groups = group_all(&[a1, a2, b1, b2]);
+        assert_eq!(groups.len(), 2);
+    }
+
+    #[test]
+    fn pairs_across_api_style_translation() {
+        // LiteLLM accepts Anthropic at ingress, forwards OpenAI to the
+        // upstream. wire_api differs, final_finish_reason differs
+        // (`end_turn` vs `stop`), primary_model differs (alias
+        // rewrite). Everything that translates must be excluded from
+        // the fingerprint — only tokens + agent_kind + session +
+        // call_count remain.
+        let mut a = mk("anth", "S", 0, 2_000_000, "client->litellm");
+        a.wire_api = "anthropic".into();
+        a.final_finish_reason = Some("end_turn".into());
+        a.primary_model = Some("claude-3-5-sonnet-20241022".into());
+        let mut b = mk("oai", "S", 2_000, 1_998_000, "litellm->upstream");
+        b.wire_api = "openai-chat".into();
+        b.final_finish_reason = Some("stop".into());
+        b.primary_model = Some("GLM-5.1".into());
+        let groups = group_all(&[a, b]);
+        assert_eq!(groups.len(), 1);
+        let g = &groups[0];
+        assert_eq!(role_of(g, "anth"), Some(ProxyRole::ProxyIn));
+        assert_eq!(role_of(g, "oai"), Some(ProxyRole::ProxyOut));
+    }
+
+    #[test]
+    fn lone_turns_omitted() {
+        let cands = vec![mk("solo", "S", 0, 1000, "view")];
+        assert!(group_all(&cands).is_empty());
+    }
+
+    #[test]
+    fn metadata_for_unknown_turn_id_returns_none() {
+        let g = ProxyGroup::new(vec![
+            GroupMember { turn_id: "t1".into(), role: ProxyRole::ProxyIn },
+            GroupMember { turn_id: "t2".into(), role: ProxyRole::ProxyOut },
+        ]);
+        assert!(g.metadata_for("unrelated").is_none());
+    }
+}