diff --git a/AGENTS.md b/AGENTS.md
index f45a8785f..0a45685fd 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -358,7 +358,7 @@ empty and is meant to stay empty.
 
 ## Workspace layout — where a change goes
 
-Twenty crates, every one under the `crates/` directory (`crates/stella-core`,
+Twenty-one crates, every one under the `crates/` directory (`crates/stella-core`,
 `crates/stella-cli`, …; the two bench members stay under `bench/`). The
 one-sentence rule of thumb below routes you to the right one; **each crate's
 own `README.md`** (linked from the table) then covers its boundary, layout,
@@ -377,6 +377,7 @@ the files you must plan around (see below).
 | Touch shared types crossing a crate boundary | [`stella-protocol`](crates/stella-protocol/README.md) | **Zero logic, zero I/O — types only.** |
 | Resolve where `~/.stella` is — home dir, stella home, the user-tier data dir | [`stella-home`](crates/stella-home/README.md) | **A leaf with NO dependencies at all**, which is what lets `stella-store` and `stella-observatory` share it (the observatory must not link the store). Every resolver has a pure `resolve_*` half that reads no environment. |
 | Emit a diagnostic — a record explaining *why* the program did something | [`stella-diag`](crates/stella-diag/README.md) | **A leaf: `serde` only, so anything may depend on it.** Field values cannot hold a `String`, a `Path`, or model output — that is a compile error, not a review question. Design: [`docs/spec/diagnostics.md`](docs/spec/diagnostics.md). |
+| Compute a line-oriented unified diff (`@@` hunks, git's exact shape) | [`stella-diff`](crates/stella-diff/README.md) | **A leaf with NO dependencies at all** (#1511) — pure functions over borrowed strings, which is what lets [`stella-observatory`](crates/stella-observatory/README.md) and [`stella-cli`](crates/stella-cli/README.md) share one differ without costing the observatory its isolation. |
 | Persistence: executions, events, telemetry (SQLite) | [`stella-store`](crates/stella-store/README.md) | |
 | Retrieval: graph, embeddings, episodic memory | [`stella-context`](crates/stella-context/README.md) | |
 | Tree-sitter code indexing | [`stella-graph`](crates/stella-graph/README.md) | |
@@ -428,7 +429,7 @@ a plan needs and the part that rarely changes:
 | `stella-tools` | `src/registry.rs`, `src/scripts.rs`, `src/media.rs` |
 | `stella-tui` | `src/deck_ui.rs`, `src/views/engine.rs`, `src/views/session.rs`, `src/deck_render.rs` |
 
-The other twelve crates carry no god files — keep it that way. Each crate's
+The other thirteen crates carry no god files — keep it that way. Each crate's
 README repeats its own list under "God files — do not add lines", so the
 constraint is in view wherever planning starts.
 
diff --git a/Cargo.lock b/Cargo.lock
index b12649472..5eaa9a8e9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3069,6 +3069,7 @@ dependencies = [
  "stella-context",
  "stella-core",
  "stella-diag",
+ "stella-diff",
  "stella-fleet",
  "stella-graph",
  "stella-home",
@@ -3134,6 +3135,10 @@ dependencies = [
  "trybuild",
 ]
 
+[[package]]
+name = "stella-diff"
+version = "0.6.126"
+
 [[package]]
 name = "stella-engine"
 version = "0.6.127"
@@ -3267,10 +3272,12 @@ dependencies = [
 name = "stella-observatory"
 version = "0.6.127"
 dependencies = [
+ "libc",
  "rusqlite",
  "serde_json",
  "sha2 0.11.0",
  "stella-core",
+ "stella-diff",
  "stella-home",
  "stella-protocol",
  "stella-store",
diff --git a/Cargo.toml b/Cargo.toml
index 3616d4f1a..0e75ea078 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -2,6 +2,7 @@
 resolver = "3"
 members = [
   "crates/stella-diag",
+  "crates/stella-diff",
   "crates/stella-home",
   "crates/stella-protocol",
   "crates/stella-core",
diff --git a/crates/stella-cli/Cargo.toml b/crates/stella-cli/Cargo.toml
index d67176592..895fd64ee 100644
--- a/crates/stella-cli/Cargo.toml
+++ b/crates/stella-cli/Cargo.toml
@@ -45,6 +45,9 @@ stella-core = { path = "../stella-core" }
 # `stella-serve` can assemble the same stack without linking a binary (#971).
 stella-runtime = { path = "../stella-runtime" }
 stella-model = { path = "../stella-model" }
+# The pure unified differ behind `stella inspect --diff`, extracted to a leaf
+# crate (#1511) so the Observatory's prompt-diff route shares it.
+stella-diff = { path = "../stella-diff" }
 stella-tools = { path = "../stella-tools" }
 stella-store = { path = "../stella-store" }
 stella-observatory = { path = "../stella-observatory" }
diff --git a/crates/stella-cli/src/inspect.rs b/crates/stella-cli/src/inspect.rs
index 761e4be30..42b077ff6 100644
--- a/crates/stella-cli/src/inspect.rs
+++ b/crates/stella-cli/src/inspect.rs
@@ -73,15 +73,14 @@
 //! they submitted — and it is invisible in every other view, since the
 //! transcript shows the sum and never the delta.
 
-mod diff;
-
 use colored::Colorize;
 use serde::Serialize;
+// The differ lives in its own zero-dep leaf crate (#1511) so the Observatory's
+// prompt-diff route and this command share one implementation.
+use stella_diff::{Diff, Op, unified_diff};
 use stella_protocol::{CompletionMessage, MessageRole, ToolOutput};
 use stella_store::{Reconstruction, RecordedCall, Store};
 
-use diff::{Diff, Op};
-
 use crate::query_format::{QueryFormat, Rows, Versioned};
 
 /// How much of a message body the text format prints before eliding. The whole
@@ -532,7 +531,7 @@ fn show_diff(
 
     let baseline = resolve_baseline(store, &target, base, args)?;
     let document = render_document(&recon, args.only);
-    let computed = diff::unified_diff(&baseline.document, &document, args.context);
+    let computed = unified_diff(&baseline.document, &document, args.context);
 
     let target_label = target.label(execution_id);
     match args.format {
diff --git a/crates/stella-diff/Cargo.toml b/crates/stella-diff/Cargo.toml
new file mode 100644
index 000000000..8d2c8eaca
--- /dev/null
+++ b/crates/stella-diff/Cargo.toml
@@ -0,0 +1,15 @@
+[package]
+name = "stella-diff"
+description = "A pure line-oriented unified diff — git's exact hunk shape, zero dependencies. The shared differ behind `stella inspect --diff` and the Observatory's prompt-diff view."
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+publish.workspace = true
+
+# Deliberately empty: this crate is pure functions over borrowed strings, the
+# `stella-home` shape (#1139) — which is what lets `stella-observatory` (which
+# links almost nothing) and `stella-cli` share one differ instead of keeping
+# acknowledged copies (#1511).
+[dependencies]
diff --git a/crates/stella-diff/README.md b/crates/stella-diff/README.md
new file mode 100644
index 000000000..77bcb130d
--- /dev/null
+++ b/crates/stella-diff/README.md
@@ -0,0 +1,40 @@
+# stella-diff
+
+A pure, line-oriented **unified diff**: trim the common prefix and suffix, run
+an exact longest-common-subsequence over what is left, and group the edit
+script into `@@ -a,b +c,d @@` hunks with context lines — git's exact shape, so
+an editor's diff mode and a human's muscle memory both parse it.
+
+## Boundary
+
+Zero dependencies, zero I/O, no types from any other stella crate: two `&str`
+documents in, a [`Diff`] out. That emptiness is the point. The differ began
+life inside `stella-cli` (`stella inspect --diff`), and the Observatory —
+which deliberately links almost no workspace crate, because an observer must
+not pull in the machinery it observes — would have had to take a fourth
+acknowledged copy to render "what changed between two model calls" (#1511).
+A leaf crate is the `stella-home` precedent (#1139): shared by linking,
+without costing any caller its isolation.
+
+## Semantics worth knowing
+
+- **Line semantics follow `str::lines()`**: `""` is zero lines and a trailing
+  newline adds none, so a trailing-newline-only difference is not a change.
+- **Removals precede additions** at a change point, as in git.
+- **`Diff::minimal`** reports whether the script is the exact minimal one.
+  Inputs whose DP table would exceed `LCS_AREA_CAP` cells degrade to a
+  correct-but-blunt replace-everything script, flagged `minimal: false` —
+  surfaces are expected to say so rather than present it as precise. (The
+  coarse companion in `stella-tools`, `file_touch::changed_region_diff`, is
+  honest for file edits; it cannot express "one paragraph inserted into four
+  hundred stable lines", which is the case this crate exists for.)
+- **Empty hunk list = byte-identical** — the honest "no change" answer, not
+  an error.
+
+## God files — do not add lines
+
+This crate has no god files: no file exceeds the gate's 1500-line ratchet
+(`scripts/check-file-size.sh`), and none may appear — a new file crossing
+1500 lines fails the gate outright, and `scripts/file-size-baseline.txt`
+accepts no new entries. When a file here approaches the limit, split it before
+it crosses.
diff --git a/crates/stella-cli/src/inspect/diff.rs b/crates/stella-diff/src/lib.rs
similarity index 85%
rename from crates/stella-cli/src/inspect/diff.rs
rename to crates/stella-diff/src/lib.rs
index dfdb58ffb..3d0bf9790 100644
--- a/crates/stella-cli/src/inspect/diff.rs
+++ b/crates/stella-diff/src/lib.rs
@@ -2,22 +2,27 @@
 //! to read, because it is the shape `git diff` produces.
 //!
 //! The tree had no unified-diff generator when this landed. `stella-tools`'
-//! [`changed_region_diff`] is the display companion to a *line-count* helper and
-//! says so in its own docs: it trims the common prefix and suffix and then
-//! prints the entire remaining span twice, once as `-` and once as `+`. That is
-//! honest and cheap for a file edit, where the changed region is small and the
-//! viewer already has the file open. It is useless for a system prompt, where
-//! the interesting change is one inserted paragraph inside four hundred stable
-//! lines — the coarse renderer would print all four hundred lines as removed
-//! and all four hundred and one as added, which is exactly the "I cannot see
-//! what actually changed" problem this module exists to end.
+//! `file_touch::changed_region_diff` is the display companion to a
+//! *line-count* helper and says so in its own docs: it trims the common prefix
+//! and suffix and then prints the entire remaining span twice, once as `-` and
+//! once as `+`. That is honest and cheap for a file edit, where the changed
+//! region is small and the viewer already has the file open. It is useless for
+//! a system prompt, where the interesting change is one inserted paragraph
+//! inside four hundred stable lines — the coarse renderer would print all four
+//! hundred lines as removed and all four hundred and one as added, which is
+//! exactly the "I cannot see what actually changed" problem this crate exists
+//! to end.
 //!
 //! So: trim the common prefix/suffix (cheap, and it shrinks the quadratic
 //! region a lot on append-mostly prompts), run an exact longest-common-
 //! subsequence over what is left, and walk the table to an edit script.
 //! Group the script into `@@` hunks with context lines.
 //!
-//! [`changed_region_diff`]: stella_tools::file_touch::changed_region_diff
+//! Extracted from `stella-cli`'s `inspect::diff` (#1511) so the Observatory's
+//! prompt-diff route and `stella inspect --diff` share one differ instead of
+//! keeping acknowledged copies. Deliberately dependency-free — the
+//! `stella-home` precedent (#1139) — so linking it costs no caller its
+//! isolation.
 
 /// Beyond this many DP cells the exact LCS is abandoned for the
 /// replace-everything bound. Mirrors `stella_tools::file_touch`'s cap for the
@@ -27,11 +32,14 @@
 /// The fallback is still a correct diff — every old line removed, every new one
 /// added — just not a minimal one, and [`Diff::minimal`] says which you got
 /// rather than letting a caller assume.
-const LCS_AREA_CAP: usize = 4_000_000;
+///
+/// Public so a caller sizing its inputs can reason about the boundary; the
+/// value is not tunable per call by design — one bound, one behaviour.
+pub const LCS_AREA_CAP: usize = 4_000_000;
 
 /// What happened to one line between the two sides.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum Op {
+pub enum Op {
     /// Present in both, unchanged — printed as a context line.
     Equal,
     /// Present only on the new side.
@@ -42,7 +50,8 @@ pub(crate) enum Op {
 
 impl Op {
     /// The single-character gutter git puts in front of the line.
-    pub(crate) fn sigil(self) -> char {
+    #[must_use]
+    pub fn sigil(self) -> char {
         match self {
             Op::Equal => ' ',
             Op::Add => '+',
@@ -51,7 +60,8 @@ impl Op {
     }
 
     /// The stable lowercase tag the JSON format emits.
-    pub(crate) fn tag(self) -> &'static str {
+    #[must_use]
+    pub fn tag(self) -> &'static str {
         match self {
             Op::Equal => "equal",
             Op::Add => "add",
@@ -62,26 +72,35 @@ impl Op {
 
 /// One line of the edit script.
 #[derive(Debug, Clone, PartialEq, Eq)]
-pub(crate) struct DiffLine {
-    pub(crate) op: Op,
-    pub(crate) text: String,
+pub struct DiffLine {
+    /// What happened to this line.
+    pub op: Op,
+    /// The line's text, without its newline.
+    pub text: String,
 }
 
 /// One `@@ -old_start,old_count +new_start,new_count @@` group: a run of
 /// changes plus the context lines framing it.
 #[derive(Debug, Clone, PartialEq, Eq)]
-pub(crate) struct Hunk {
-    pub(crate) old_start: usize,
-    pub(crate) old_count: usize,
-    pub(crate) new_start: usize,
-    pub(crate) new_count: usize,
-    pub(crate) lines: Vec<DiffLine>,
+pub struct Hunk {
+    /// 1-based first line of the hunk on the old side (0 when the old side is
+    /// empty — see [`Hunk::header`]).
+    pub old_start: usize,
+    /// Lines of the hunk present on the old side.
+    pub old_count: usize,
+    /// 1-based first line of the hunk on the new side.
+    pub new_start: usize,
+    /// Lines of the hunk present on the new side.
+    pub new_count: usize,
+    /// The hunk's lines, in script order.
+    pub lines: Vec<DiffLine>,
 }
 
 impl Hunk {
     /// The `@@ … @@` header, in git's exact format so an editor's diff mode and
     /// a human's muscle memory both parse it.
-    pub(crate) fn header(&self) -> String {
+    #[must_use]
+    pub fn header(&self) -> String {
         format!(
             "@@ -{},{} +{},{} @@",
             self.old_start, self.old_count, self.new_start, self.new_count
@@ -92,21 +111,25 @@ impl Hunk {
 /// A complete comparison: the hunks, plus the accounting a caller would
 /// otherwise be tempted to re-derive by counting sigils in rendered text.
 #[derive(Debug, Clone, PartialEq, Eq)]
-pub(crate) struct Diff {
-    pub(crate) hunks: Vec<Hunk>,
-    pub(crate) added: usize,
-    pub(crate) removed: usize,
+pub struct Diff {
+    /// The `@@`-grouped changes, in document order. Empty means byte-identical.
+    pub hunks: Vec<Hunk>,
+    /// Lines present only on the new side.
+    pub added: usize,
+    /// Lines present only on the old side.
+    pub removed: usize,
     /// Whether the edit script is the minimal one. `false` means the input
     /// exceeded [`LCS_AREA_CAP`] and fell back to replace-everything — the diff
     /// is still correct, just blunt, and surfaces are expected to say so rather
     /// than present it as a precise answer.
-    pub(crate) minimal: bool,
+    pub minimal: bool,
 }
 
 impl Diff {
     /// Whether the two sides differ at all. An empty hunk list is the honest
     /// "byte-identical" answer, not an error.
-    pub(crate) fn changed(&self) -> bool {
+    #[must_use]
+    pub fn changed(&self) -> bool {
         !self.hunks.is_empty()
     }
 }
@@ -117,7 +140,8 @@ impl Diff {
 /// Line semantics follow `str::lines()`, matching `count_lines` in
 /// `stella-tools`: `""` is zero lines and a trailing newline adds none. Two
 /// empty inputs therefore produce no hunks rather than one empty hunk.
-pub(crate) fn unified_diff(old: &str, new: &str, context: usize) -> Diff {
+#[must_use]
+pub fn unified_diff(old: &str, new: &str, context: usize) -> Diff {
     let old_lines: Vec<&str> = old.lines().collect();
     let new_lines: Vec<&str> = new.lines().collect();
 
@@ -356,7 +380,7 @@ mod tests {
     #[test]
     fn an_insertion_in_a_stable_body_shows_only_the_inserted_line() {
         // The case the coarse `changed_region_diff` cannot express, and the
-        // reason this module exists: one line lands in the middle of a long
+        // reason this crate exists: one line lands in the middle of a long
         // stable body, and everything else must stay context.
         let old = (1..=20)
             .map(|i| i.to_string())
diff --git a/crates/stella-observatory/Cargo.toml b/crates/stella-observatory/Cargo.toml
index 0bef6c222..ca175fce0 100644
--- a/crates/stella-observatory/Cargo.toml
+++ b/crates/stella-observatory/Cargo.toml
@@ -28,6 +28,16 @@ stella-home = { path = "../stella-home" }
 # opposite shape — pure decision logic over owned data, no I/O by invariant 2,
 # with the clock passed in as a parameter. Linking it opens nothing.
 stella-core = { path = "../stella-core" }
+# The pure unified differ behind `/api/execution-context-diff` (#1511) —
+# extracted from `stella-cli`'s `inspect::diff` precisely so this crate could
+# link it instead of taking a fourth acknowledged copy. Zero dependencies,
+# zero I/O (the `stella-home` shape), so the observer boundary holds.
+stella-diff = { path = "../stella-diff" }
+# One syscall: `kill(pid, 0)` in `sessions::pid_alive`, the read-time liveness
+# probe the session registry's readers all share (an acknowledged copy of
+# `stella_store::sessions::pid_alive` — see that fn's doc). Probing a pid
+# opens nothing and writes nothing, so the observer boundary holds.
+libc.workspace = true
 rusqlite.workspace = true
 serde_json = { workspace = true }
 # Re-hash exploration-map manifests for the /api/explorations freshness
diff --git a/crates/stella-observatory/README.md b/crates/stella-observatory/README.md
index 26cda917d..0f781ab0b 100644
--- a/crates/stella-observatory/README.md
+++ b/crates/stella-observatory/README.md
@@ -39,12 +39,18 @@ instead (#1139). `src/self_driving.rs` was another: a private `fold_runs` and
 the two had already drifted — the dashboard and `stella self-driving metrics`
 disagreed about whether the loop was NOISY for every odd cycle count, because
 one tested `2 * new < n` and the other `new < n / 2` in integer arithmetic
-(#1613). Both now come from `stella-core`. Three copies remain:
-`project_id_for` ([`src/global.rs`](src/global.rs)) still mirrors the
-store's, `/api/explorations` re-hashes exploration manifests itself, and
+(#1613). Both now come from `stella-core`. The unified differ took the same
+exit before ever becoming a copy: `/api/execution-context-diff` links
+`stella-diff`, the zero-dependency leaf crate the CLI's `inspect::diff` was
+extracted into (#1511). Four copies remain: `project_id_for`
+([`src/global.rs`](src/global.rs)) still mirrors the store's,
+`/api/explorations` re-hashes exploration manifests itself,
+`sessions::pid_alive` ([`src/sessions.rs`](src/sessions.rs)) mirrors
+`stella_store::sessions::pid_alive` (one `kill(pid, 0)` probe, including the
+pid_t-overflow-reads-as-dead rule), and
 [`src/sent_context.rs`](src/sent_context.rs) re-implements the receipt
 reconstruction `stella_store::Store::reconstruct_call` performs (#1475). The
-last is the largest of the three and the only one with a *byte-level* coupling
+last is the largest of the four and the only one with a *byte-level* coupling
 — it rebuilds a `tool_call` block's preimage in `stella_protocol::ToolCall`'s
 field order — so `tests/schema_conformance.rs` seeds its digests from that
 crate's own serializer: a reordered field fails the suite instead of printing
@@ -65,6 +71,8 @@ free one). This crate builds no binary —
 | [`src/lib.rs`](src/lib.rs) | The HTTP responder: the route table, the `Host` and head-cap gates, the CSP, `serve`. Open it to add a route or to touch anything security-relevant. |
 | [`src/db.rs`](src/db.rs) | Every query against `.stella/private/store.db` and `fleet.db`. Open it when a panel needs a new aggregate; the SQL deliberately mirrors `stella stats` semantics (resolved = outcome `completed`, `off-grid` = provider `local`). |
 | [`src/sent_context.rs`](src/sent_context.rs) | `/api/execution-context`: the receipt queries (`step_receipt`, `step_manifest`, `context_blocks`) and the fold that rebuilds the messages one model call was sent, with the digest-verification verdict. Kept out of `src/db.rs` so that file stays clear of the 1500-line ratchet. |
+| [`src/context_diff.rs`](src/context_diff.rs) | `/api/execution-context-diff` (#1511): `stella inspect --diff`, served — the unified diff between one call's reconstruction and its resolved baseline (`prev`/`first`/`prompt`, same-role, whole-session). The differ itself is the `stella-diff` leaf crate. |
+| [`src/sessions.rs`](src/sessions.rs) | The sessions plane: the `~/.stella/sessions/` registry (with the read-time pid-liveness downgrade) merged with per-session store rollups (`/api/sessions`, `/api/session`), plus the per-execution behavioural-tendencies fold (`/api/execution-tendencies`). |
 | [`src/global.rs`](src/global.rs) | The user-tier view over `~/.stella/usage.db`: the project switcher (`/api/projects`, `?project=`) and the hub-telemetry drill (org → workspace → repo → project). |
 | [`src/fsview.rs`](src/fsview.rs) | Views derived from files rather than SQL — skills, memories, rule files, `reflections.jsonl` lessons, `mcp.toml`, the settings scope chain, exploration maps — plus `redact`, the credential scrubber. |
 | [`src/self_driving.rs`](src/self_driving.rs) | The perpetual delivery loop's runs, cycles and controller state, read from `~/.stella/self-driving/<slug>/`. Plain JSONL, no database — see below for why the `crashed` status is computed here rather than read. |
diff --git a/crates/stella-observatory/src/assets/index.html b/crates/stella-observatory/src/assets/index.html
index 9ba3dd522..74a855ea4 100644
--- a/crates/stella-observatory/src/assets/index.html
+++ b/crates/stella-observatory/src/assets/index.html
@@ -357,6 +357,7 @@ <h1>observatory</h1>
   <nav class="bar" aria-label="Dashboard">
     <div class="tabs" id="tabs" role="tablist" aria-label="Sections">
       <button role="tab" id="tab-overview" aria-controls="panel-overview" data-tab="overview">Overview</button>
+      <button role="tab" id="tab-sessions" aria-controls="panel-sessions" data-tab="sessions">Sessions</button>
       <button role="tab" id="tab-activity" aria-controls="panel-activity" data-tab="activity">Activity</button>
       <button role="tab" id="tab-graph" aria-controls="panel-graph" data-tab="graph">Code graph</button>
       <button role="tab" id="tab-skills" aria-controls="panel-skills" data-tab="skills">Skills</button>
@@ -381,6 +382,47 @@ <h1>observatory</h1>
   <main id="main" tabindex="-1">
   <div class="err" id="err" role="alert" hidden></div>
 
+  <!-- ══ SESSIONS ══════════════════════════════════════════════════════ -->
+  <section data-tab="sessions" id="panel-sessions" role="tabpanel" aria-labelledby="tab-sessions" tabindex="0">
+    <div class="grid kpis" id="ses-kpis"></div>
+    <div class="card section-gap">
+      <div class="kick">Every session of this workspace · registry + store · select one</div>
+      <h2>Sessions</h2>
+      <div class="scroll-x" id="ses-list"></div>
+    </div>
+    <div class="card section-gap" id="ses-detail-card" hidden>
+      <div class="kick" id="ses-detail-kick">Nothing selected</div>
+      <h2 id="ses-detail-title">Session replay</h2>
+      <div id="ses-summary"></div>
+      <div class="kick" style="margin-top:12px">Turn by turn · oldest first · select a turn to replay it</div>
+      <div class="scroll-x" id="ses-turns"></div>
+    </div>
+    <div class="grid cols-2" id="ses-panels" hidden>
+      <div class="card">
+        <div class="kick">Skills applied &amp; subagents dispatched</div>
+        <h2>Skills &amp; agents</h2>
+        <div class="scroll-y" id="ses-skills"></div>
+      </div>
+      <div class="card">
+        <div class="kick">External tool servers · per (server, tool)</div>
+        <h2>MCP traffic</h2>
+        <div class="scroll-y" id="ses-mcp"></div>
+      </div>
+    </div>
+    <div class="grid cols-2" id="ses-panels2" hidden>
+      <div class="card">
+        <div class="kick">Lessons mined · memories kept · context cited</div>
+        <h2>Self-improvement</h2>
+        <div class="scroll-y" id="ses-improve"></div>
+      </div>
+      <div class="card">
+        <div class="kick">Task board &amp; pull requests</div>
+        <h2>Outcomes</h2>
+        <div class="scroll-y" id="ses-outcomes"></div>
+      </div>
+    </div>
+  </section>
+
   <!-- ══ ORG / HUB ═════════════════════════════════════════════════════ -->
   <section data-tab="hub" id="panel-hub" role="tabpanel" aria-labelledby="tab-hub" tabindex="0">
     <div class="card section-gap">
@@ -1043,7 +1085,8 @@ <h2>${fmtInt(runs)} undated ${runs === 1 ? "run" : "runs"}
     const r = top[i];
     el.addEventListener("mousemove", ev => showTip(ev,
       `<b>${esc(r.name)}</b>${fmtInt(r.calls)} calls · ${fmtInt(r.errors)} errors<br>` +
-      `p50 ${fmtMs(r.p50_ms)} · max ${fmtMs(r.max_ms)} · ${fmtTok(r.bytes_out)}B returned`));
+      `p50 ${fmtMs(r.p50_ms)} · p90 ${fmtMs(r.p90_ms)} · p99 ${fmtMs(r.p99_ms)} · ` +
+      `max ${fmtMs(r.max_ms)} · ${fmtTok(r.bytes_out)}B returned`));
     el.addEventListener("mouseleave", hideTip);
   });
 }
@@ -1230,6 +1273,11 @@ <h2>${fmtInt(runs)} undated ${runs === 1 ? "run" : "runs"}
      prompt, so it loads on demand when a row is drilled into. */
   let cx = null;
   try { cx = await api(`/api/execution-context?id=${encodeURIComponent(id)}`); } catch { cx = null; }
+  /* The behavioural tendencies fold: retries, loop detections, compactions,
+     policy verdicts — the "how it went" beside the transcript's "what it
+     did". All-zero payloads render no section at all. */
+  let td = null;
+  try { td = await api(`/api/execution-tendencies?id=${encodeURIComponent(id)}`); } catch { td = null; }
   const entries = Array.isArray(j) ? j : [];
   const jrnl = entries.map(journalEntryHtml).join("");
   // Rendered even with zero entries while the run is still going: the
@@ -1284,6 +1332,7 @@ <h2 id="drawerTitle">${esc(d.prompt)}</h2>
     ${steps ? `<div class="sect"><div class="kick">Per-step tokens and latency</div>${steps}</div>`
             : `<div class="sect"><div class="kick">Per-step tokens and latency</div>
                <div class="empty">No steps recorded for this run.</div></div>`}
+    ${tendenciesSectionHtml(td)}
     ${sentContextSectionHtml(cx)}
     ${jrnlSect}
     ${tools ? `<div class="sect"><div class="kick">Tool calls</div>${tools}</div>` : ""}
@@ -1295,6 +1344,10 @@ <h2 id="drawerTitle">${esc(d.prompt)}</h2>
     b.addEventListener("click", () =>
       loadSentContext(id, +b.dataset.turn, +b.dataset.step, +b.dataset.seq));
   }
+  for (const b of $("drawer").querySelectorAll(".ctx-diff")) {
+    b.addEventListener("click", () =>
+      loadContextDiff(id, +b.dataset.turn, +b.dataset.step, +b.dataset.seq));
+  }
   drawerState = {
     id,
     full,
@@ -1338,6 +1391,36 @@ <h2 id="drawerTitle">${esc(d.prompt)}</h2>
   }
   drawerState.lastSeq = entries[entries.length - 1].seq;
 }
+/* One execution's behavioural-tendency strip: badges for every nonzero
+   counter the journal fold reported. All-zero (or unreachable) payloads
+   render nothing — an uneventful run should not grow a section saying so.
+   Loop kinds and policy verdicts are maps whose keys come from the journal;
+   they are workspace-derived strings and go through esc() like the rest. */
+function tendenciesSectionHtml(td) {
+  if (!td) return "";
+  const chips = [];
+  const chip = (n, label, cls) => {
+    if (num(n) > 0) chips.push(`<span class="badge ${cls}">${fmtInt(n)} ${esc(label)}</span>`);
+  };
+  chip(td.retries, "retries", "warn");
+  chip(td.retries_exhausted, "retries exhausted", "bad");
+  for (const [kind, n] of Object.entries(td.loops ?? {}))
+    chip(n, `loop: ${kind}`, "warn");
+  chip(td.loop_aborts, "loop aborts", "bad");
+  chip(td.budget_denied, "budget denied", "bad");
+  chip(td.compactions, "compactions", "dim");
+  if (num(td.tokens_reclaimed) > 0)
+    chips.push(`<span class="badge dim">${fmtTok(td.tokens_reclaimed)} tok reclaimed</span>`);
+  for (const [kind, n] of Object.entries(td.policy ?? {}))
+    chip(n, `policy: ${kind}`, kind === "blocked" || kind === "secret_detected" ? "bad" : "dim");
+  chip(td.speculation_discarded, "speculation discarded", "dim");
+  chip(td.steered, "steered", "warn");
+  chip(td.provider_fallback, "provider fallback", "warn");
+  chip(td.usage_incomplete, "usage incomplete", "warn");
+  if (!chips.length) return "";
+  return `<div class="sect"><div class="kick">Tendencies</div>
+    <p style="margin:6px 0 0;display:flex;flex-wrap:wrap;gap:6px">${chips.join(" ")}</p></div>`;
+}
 /* ── sent context (#1475) ────────────────────────────────────────────────
    What a model call was *given*, as opposed to what the run did: the
    message array rebuilt server-side from that call's context receipt, the
@@ -1362,7 +1445,11 @@ <h2 id="drawerTitle">${esc(d.prompt)}</h2>
         num(c.turn) || num(c.call_seq) ? ` · turn ${fmtInt(c.turn)} seq ${fmtInt(c.call_seq)}` : ""}</span>
       <span><button type="button" class="jrnl-full ctx-call" data-turn="${esc(String(c.turn))}"
         data-step="${esc(String(c.step))}" data-seq="${esc(String(c.call_seq))}"
-        >context sent</button></span>
+        >context sent</button>
+      <button type="button" class="jrnl-full ctx-diff" data-turn="${esc(String(c.turn))}"
+        data-step="${esc(String(c.step))}" data-seq="${esc(String(c.call_seq))}"
+        title="unified diff against the previous call of this role"
+        >what changed</button></span>
     </div>`).join("");
   return `<div class="sect"><div class="kick">Context sent</div>${rows}
     <div id="ctx-body"></div></div>`;
@@ -1417,6 +1504,50 @@ <h2 id="drawerTitle">${esc(d.prompt)}</h2>
   const btn = $("ctx-full");
   if (btn) btn.addEventListener("click", () => loadSentContext(id, turn, step, callSeq, true));
 }
+/* What changed since the previous call of this role (#1511): the served
+   `stella inspect --diff`. Hunks arrive in git's exact shape; add/remove
+   coloring mirrors the terminal's. The resolved base is reported, not the
+   requested one — `prev` on a role's first call resolves to `prompt` — and a
+   coarse (non-minimal) diff says so instead of posing as a precise answer. */
+async function loadContextDiff(id, turn, step, callSeq, only = "all") {
+  const body = $("ctx-body");
+  if (!body) return;
+  let d = null;
+  try {
+    d = await api(`/api/execution-context-diff?id=${encodeURIComponent(id)}`
+      + `&turn=${encodeURIComponent(turn)}&step=${encodeURIComponent(step)}`
+      + `&call_seq=${encodeURIComponent(callSeq)}&base=prev&only=${encodeURIComponent(only)}`);
+  } catch { d = null; }
+  if (!d || !d.found) {
+    body.innerHTML = `<div class="empty">${
+      esc((d && d.note) || "That call has no recorded receipt to diff.")}</div>`;
+    return;
+  }
+  const scopeBtn = `<button type="button" class="jrnl-full" id="ctx-diff-scope">${
+    only === "all" ? "system only" : "all roles"}</button>`;
+  if (!d.changed) {
+    body.innerHTML = `<div class="kick">--- ${esc(d.base_label)} · +++ ${esc(d.target_label)}</div>
+      <div class="empty">no change: the ${esc(d.scope)} are byte-identical to ${esc(d.base_label)}.</div>
+      ${scopeBtn}`;
+  } else {
+    const hunks = (d.hunks ?? []).map(h => `<pre class="jrnl-body">${
+      esc(`@@ -${num(h.old_start)},${num(h.old_count)} +${num(h.new_start)},${num(h.new_count)} @@`)}
+${(h.lines ?? []).map(l => {
+        const sigil = l.op === "add" ? "+" : l.op === "remove" ? "−" : " ";
+        const color = l.op === "add" ? "var(--ok)" : l.op === "remove" ? "var(--bad)" : "inherit";
+        return `<span style="color:${color}">${esc(sigil + l.text)}</span>`;
+      }).join("\n")}</pre>`).join("");
+    body.innerHTML = `<div class="kick">--- ${esc(d.base_label)} · +++ ${esc(d.target_label)}</div>
+      <div class="kick"><span style="color:var(--ok)">+${fmtInt(d.added)}</span> ·
+        <span style="color:var(--bad)">−${fmtInt(d.removed)}</span> (${esc(d.scope)}${
+        d.minimal ? "" : ` · <span style="color:var(--warn)">coarse: input too large for an exact diff</span>`}${
+        d.base === "prompt" ? " · baseline: prompt as submitted" : ""})</div>
+      ${hunks}${scopeBtn}`;
+  }
+  const scope = $("ctx-diff-scope");
+  if (scope) scope.addEventListener("click", () =>
+    loadContextDiff(id, turn, step, callSeq, only === "all" ? "system" : "all"));
+}
 /* The main poll already re-fetches `/api/executions` (with `finished_at`)
    on every cursor move — reuse that instead of a dedicated per-tick
    `/api/execution` call just to learn the drawer's execution closed out. */
@@ -2157,7 +2288,7 @@ <h2 id="drawerTitle">${esc(d.prompt)}</h2>
   const titles = { org: "By org", workspace: "By workspace", repo: "By repo", project: "By project" };
   $("hubDrillTitle").textContent = pick(titles, level, "Breakdown");
   $("hubDrillKick").textContent = level === "project"
-    ? "Select a project to open its dashboard" : "Select a row to drill in";
+    ? "Select a project to open its sessions" : "Select a row to drill in";
   const rows = d.drill?.rows ?? [];
   hubDrillRows = rows; hubDrillLevel = level;
   if (!rows.length) {
@@ -2233,7 +2364,10 @@ <h2 id="drawerTitle">${esc(d.prompt)}</h2>
   if (level === "org") { hub.org = r.key == null ? "(local)" : r.key; hubReload(); }
   else if (level === "workspace") { hub.workspace = r.key == null ? "(local)" : r.key; hubReload(); }
   else if (level === "repo") { hub.repo = r.key === "" ? "(local)" : r.key; hubReload(); }
-  else if (level === "project") { state.project = r.key; renderProjects(D.projects); switchTab("overview"); }
+  // The end of the hub's descent: org → workspace → repo → project lands on
+  // the project's *sessions*, so the drill continues seamlessly down through
+  // session → turn → step → tool call instead of dead-ending at tiles.
+  else if (level === "project") { state.project = r.key; renderProjects(D.projects); switchTab("sessions"); }
 });
 
 /* ── self-driving: the perpetual delivery loop ───────────────────────────── */
@@ -2387,6 +2521,185 @@ <h2 id="drawerTitle">${esc(d.prompt)}</h2>
   if (tr) openSelfDrivingRun(tr.dataset.run);
 });
 
+/* ── sessions: list, replay drill, self-improvement residue ──────────────
+   The session list merges two sources the server keeps honest about
+   (`registry: false` marks a session the registry has pruned but the store
+   still remembers). Drilling a session lists its turns oldest-first; drilling
+   a turn opens the same execution drawer the Overview uses — transcript,
+   sent context, tendencies — so the replay path is one continuous descent:
+   session → turn → step → call → block/tool. Every workspace- or
+   model-derived string routes through esc(). */
+function sesBadge(s, crashed) {
+  if (crashed) return `<span class="badge bad">crashed</span>`;
+  const cls = pick({
+    in_progress: "ok", needs_input: "warn", paused: "dim", cancelled: "dim",
+    complete: "ok", archived: "dim", error: "bad",
+  }, s, "dim");
+  const label = pick({
+    in_progress: "live", needs_input: "needs input", paused: "paused",
+    cancelled: "cancelled", complete: "complete", archived: "archived",
+    error: "error",
+  }, s, s ? String(s) : "pruned");
+  return `<span class="badge ${cls}">${esc(label)}</span>`;
+}
+function cachePct(read, miss) {
+  const t = num(read) + num(miss);
+  return t ? (100 * num(read) / t).toFixed(0) + "%" : "—";
+}
+function renderSessions(d) {
+  const rows = d?.sessions ?? [];
+  const live = rows.filter(r => r.live).length;
+  const turns = rows.reduce((a, r) => a + num(r.turns), 0);
+  const spend = rows.reduce((a, r) => a + num(r.cost_usd), 0);
+  $("ses-kpis").innerHTML =
+    tile("Sessions", fmtInt(rows.length), fmtInt(live) + " live now", live > 0) +
+    tile("Turns", fmtInt(turns), "across every listed session") +
+    tile("Spend", fmtUsd(spend), "sum of listed sessions") +
+    tile("Tool calls", fmtInt(rows.reduce((a, r) => a + num(r.tool_calls), 0)),
+      fmtInt(rows.reduce((a, r) => a + num(r.tool_errors), 0)) + " errored");
+  $("ses-list").innerHTML = rows.length ? `<table><thead><tr>
+      <th>Session</th><th>Status</th><th class="num">Turns</th>
+      <th class="num">Tools</th><th class="num">Files</th><th class="num">Tokens</th>
+      <th class="num">Cache</th><th class="num">Skills</th><th class="num">MCP</th>
+      <th class="num">Cost</th><th>Updated</th></tr></thead><tbody>
+    ${rows.map(r => `<tr data-ses="${esc(r.id)}">
+      <td><span class="name" title="${esc(r.id)}">${esc(clip(r.title || r.summary || r.id, 64))}</span>${
+        r.supervised ? ` <span class="badge dim">supervised</span>` : ""}${
+        r.registry ? "" : ` <span class="badge dim">store only</span>`}</td>
+      <td>${sesBadge(r.status, r.crashed)}</td>
+      <td class="num">${fmtInt(r.turns)}</td>
+      <td class="num">${fmtInt(r.tool_calls)}${num(r.tool_errors)
+        ? ` <span style="color:var(--bad)">✕${fmtInt(r.tool_errors)}</span>` : ""}</td>
+      <td class="num">${fmtInt(r.files_touched)}</td>
+      <td class="num">${fmtTok(num(r.input_tokens) + num(r.output_tokens))}</td>
+      <td class="num">${cachePct(r.cache_read_tokens, r.cache_miss_tokens)}</td>
+      <td class="num">${fmtInt(r.skill_uses)}</td>
+      <td class="num">${fmtInt(r.mcp_calls)}</td>
+      <td class="num">${fmtUsd(r.cost_usd)}</td>
+      <td>${r.updated_at_ms ? agoMs(r.updated_at_ms) : "—"}</td></tr>`).join("")}
+    </tbody></table>`
+    : `<div class="empty">No sessions recorded yet. Run <code>stella</code> in this
+       workspace and the session appears here as it works.</div>`;
+  if (state.session && rows.some(r => r.id === state.session)) {
+    openSession(state.session, true);
+  } else if (rows.length) {
+    openSession(rows[0].id, true);
+  }
+}
+function turnRowHtml(t, i) {
+  const rating = t.reflection && t.reflection.self_rating != null
+    ? `${fmtInt(t.reflection.self_rating)}/10` : "—";
+  return `<tr data-exec="${fmtInt(t.id)}">
+    <td class="num">${fmtInt(i + 1)}</td>
+    <td><span class="name" title="execution ${fmtInt(t.id)}">${esc(clip(t.prompt ?? "", 80))}</span>${
+      (t.skills ?? []).map(s => ` <span class="badge accent">${esc(s)}</span>`).join("")}${
+      (t.mcp_servers ?? []).map(s => ` <span class="badge dim">${esc(s)}</span>`).join("")}</td>
+    <td>${badge(t.outcome)}</td>
+    <td class="num">${fmtInt(t.steps)}</td>
+    <td class="num">${fmtInt(t.tool_calls)}${num(t.tool_errors)
+      ? ` <span style="color:var(--bad)">✕${fmtInt(t.tool_errors)}</span>` : ""}</td>
+    <td class="num">${fmtInt(t.files_touched)}
+      <span style="color:var(--ok)">+${fmtInt(t.lines_added)}</span>
+      <span style="color:var(--bad)">−${fmtInt(t.lines_removed)}</span></td>
+    <td class="num">${fmtTok(t.input_tokens)}·${fmtTok(t.output_tokens)}</td>
+    <td class="num">${cachePct(t.cache_read_tokens, t.cache_miss_tokens)}</td>
+    <td class="num">${num(t.retries) ? `<span style="color:var(--warn)">${fmtInt(t.retries)}</span>` : "0"}</td>
+    <td class="num">${fmtUsd(t.cost_usd)}</td>
+    <td class="num">${rating}</td>
+    <td class="num">${num(t.receipts) ? "✓" : "—"}</td></tr>`;
+}
+async function openSession(id, quiet) {
+  state.session = id;
+  [...document.querySelectorAll("#ses-list tbody tr")].forEach(tr =>
+    tr.classList.toggle("sel", tr.dataset.ses === id));
+  let d;
+  try {
+    d = await api("/api/session?id=" + encodeURIComponent(id));
+  } catch (e) {
+    if (!quiet) fail("Could not load that session.", e);
+    return;
+  }
+  $("ses-detail-card").hidden = false;
+  $("ses-panels").hidden = false;
+  $("ses-panels2").hidden = false;
+  const reg = d?.registry;
+  const turns = d?.turns ?? [];
+  $("ses-detail-kick").textContent = id;
+  $("ses-detail-title").innerHTML = `${esc(clip(reg?.title || turns[0]?.prompt || id, 90))} ${
+    sesBadge(reg?.status, reg?.crashed)}`;
+  const retries = turns.reduce((a, t) => a + num(t.retries), 0);
+  const calls = turns.reduce((a, t) => a + num(t.tool_calls), 0);
+  const errs = turns.reduce((a, t) => a + num(t.tool_errors), 0);
+  const read = turns.reduce((a, t) => a + num(t.cache_read_tokens), 0);
+  const miss = turns.reduce((a, t) => a + num(t.cache_miss_tokens), 0);
+  const rated = turns.filter(t => t.reflection && t.reflection.self_rating != null);
+  const avgRating = rated.length
+    ? (rated.reduce((a, t) => a + num(t.reflection.self_rating), 0) / rated.length).toFixed(1)
+    : null;
+  $("ses-summary").innerHTML = `
+    ${reg?.summary ? `<div class="feed-item"><b>Now</b> — ${esc(reg.summary)}</div>` : ""}
+    <div class="feed-item"><b>Tendencies</b> —
+      ${fmtInt(retries)} retries ·
+      ${calls ? (100 * errs / calls).toFixed(0) : 0}% tool errors ·
+      ${cachePct(read, miss)} cache hits${
+      avgRating ? ` · self-rated ${esc(avgRating)}/10 over ${fmtInt(rated.length)} turns` : ""}</div>
+    ${reg?.exploring?.length ? `<div class="feed-item"><b>Exploring</b> — ${
+      reg.exploring.map(esc).join(", ")}</div>` : ""}
+    ${d?.turns_truncated ? `<div class="feed-item"><b>Note</b> — showing the newest
+      turns only; older turns were clipped from this view.</div>` : ""}`;
+  $("ses-turns").innerHTML = turns.length ? `<table><thead><tr>
+      <th class="num">#</th><th>Turn</th><th>Outcome</th><th class="num">Steps</th>
+      <th class="num">Tools</th><th class="num">Files</th><th class="num">Tok in·out</th>
+      <th class="num">Cache</th><th class="num">Retries</th><th class="num">Cost</th>
+      <th class="num">Rated</th><th class="num">Receipts</th></tr></thead><tbody>
+    ${turns.map(turnRowHtml).join("")}</tbody></table>`
+    : `<div class="empty">No turns stamped for this session yet${
+       reg ? " — it may not have completed a turn" : ""}.</div>`;
+  const skills = d?.skills ?? [], agents = d?.agents ?? [];
+  $("ses-skills").innerHTML = (skills.length || agents.length) ? `
+    ${skills.map(s => `<div class="feed-item"><b>${esc(s.skill)}</b> —
+      ${fmtInt(s.uses)} use(s), v${fmtInt(s.version)}</div>`).join("")}
+    ${agents.map(a => `<div class="feed-item"><b>${esc(a.agent)}</b>
+      <span class="badge dim">agent</span> — ${fmtInt(a.uses)} dispatch(es)</div>`).join("")}`
+    : `<div class="empty">No skills applied or subagents dispatched.</div>`;
+  const mcp = d?.mcp ?? [];
+  $("ses-mcp").innerHTML = mcp.length ? `<table><thead><tr>
+      <th>Server</th><th>Tool</th><th class="num">Calls</th><th>Last</th></tr></thead><tbody>
+    ${mcp.map(m => `<tr><td>${esc(m.server)}</td><td>${esc(m.tool)}</td>
+      <td class="num">${fmtInt(m.calls)}</td>
+      <td>${m.last_called_at_ms ? agoMs(m.last_called_at_ms) : "—"}</td></tr>`).join("")}
+    </tbody></table>` : `<div class="empty">No MCP calls in this session.</div>`;
+  const lessons = d?.lessons ?? [], writes = d?.memory_writes ?? [], cites = d?.memory ?? [];
+  $("ses-improve").innerHTML = (lessons.length || writes.length || cites.length) ? `
+    ${lessons.map(l => `<div class="feed-item"><b>lesson</b>
+      <span class="badge dim">${esc(l.kind)}</span> — ${esc(clip(l.content, 200))}</div>`).join("")}
+    ${writes.map(w => `<div class="feed-item"><b>memory kept</b> —
+      ${esc(w.slug || "(unnamed)")}${w.ok ? "" : ` <span class="badge bad">failed</span>`}
+      <span class="when">turn ${fmtInt(w.execution_id)}</span></div>`).join("")}
+    ${cites.map(c => `<div class="feed-item"><b>cited</b> — ${esc(c.memory_id)} ·
+      ${fmtInt(c.citations)}×${c.avg_useful_score != null
+        ? ` · useful ${num(c.avg_useful_score).toFixed(1)}` : ""}${
+      num(c.untruthful) ? ` · <span style="color:var(--bad)">${fmtInt(c.untruthful)} untruthful</span>` : ""}</div>`).join("")}`
+    : `<div class="empty">This session has not left self-improvement residue yet.</div>`;
+  const tasks = d?.tasks ?? [], prs = d?.pull_requests ?? [];
+  $("ses-outcomes").innerHTML = (tasks.length || prs.length) ? `
+    ${tasks.map(t => `<div class="feed-item"><b>#${esc(t.task_id)}</b>
+      ${badge(t.status)} — ${esc(clip(t.subject, 120))}${
+      t.owner ? ` <span class="when">${esc(t.owner)}</span>` : ""}</div>`).join("")}
+    ${prs.map(p => `<div class="feed-item"><b>PR ${p.number ? "#" + fmtInt(p.number) : ""}</b>
+      ${badge(p.status)}${p.ci_status ? ` · CI ${esc(p.ci_status)}` : ""} —
+      <span class="name" title="${esc(p.url)}">${esc(clip(p.url, 80))}</span></div>`).join("")}`
+    : `<div class="empty">No task board or pull requests recorded.</div>`;
+}
+$("ses-list").addEventListener("click", (ev) => {
+  const tr = ev.target.closest("tr[data-ses]");
+  if (tr) openSession(tr.dataset.ses);
+});
+$("ses-turns").addEventListener("click", (ev) => {
+  const tr = ev.target.closest("tr[data-exec]");
+  if (tr) openDrawer(+tr.dataset.exec);
+});
+
 /* ── tabs, lazy loads, refresh loop ──────────────────────────────────── */
 async function loadTab(tab, force) {
   const key = `${tab}:${state.project}`;
@@ -2416,6 +2729,11 @@ <h2 id="drawerTitle">${esc(d.prompt)}</h2>
       lazyCache[`skills:${state.project}`] = data;
       lazyCache[key] = data;
       renderImprove(data ?? []);
+    } else if (tab === "sessions") {
+      // Never cached, same reasoning as self-driving: a session's liveness
+      // (live / needs-input / crashed) is the point of the list, and the
+      // pid-derived downgrade only happens server-side at read time.
+      renderSessions(await api("/api/sessions") ?? {});
     } else if (tab === "self-driving") {
       // Never cached: a running loop's phase and heartbeat are the point, and a
       // cached "● running, 3s ago" that is actually twenty minutes old would be
@@ -2595,6 +2913,9 @@ <h2 id="drawerTitle">${esc(d.prompt)}</h2>
       await refresh();
       await refreshDrawerJournal();
       checkDrawerFinished();
+      // The sessions tab is lazy-loaded and never cached; while it is the one
+      // on screen, a moved cursor means its liveness column is stale too.
+      if (state.tab === "sessions") loadTab("sessions", true);
     }
     $("live").classList.remove("paused");
   } catch {
@@ -2675,6 +2996,7 @@ <h2 id="drawerTitle">${esc(d.prompt)}</h2>
     if (payload.changed) {
       refresh().then(checkDrawerFinished);
       refreshDrawerJournal();
+      if (state.tab === "sessions") loadTab("sessions", true);
     }
   });
   source.onerror = () => {
diff --git a/crates/stella-observatory/src/context_diff.rs b/crates/stella-observatory/src/context_diff.rs
new file mode 100644
index 000000000..ac0bccd84
--- /dev/null
+++ b/crates/stella-observatory/src/context_diff.rs
@@ -0,0 +1,317 @@
+//! What changed between two model calls (#1511): `stella inspect --diff`,
+//! served — a unified diff between one call's reconstructed context and an
+//! earlier state of the same conversation.
+//!
+//! Printing the whole context (`sent_context`) answers "what did the model
+//! see". It is the wrong tool for "what did *this* call see that the last one
+//! didn't": a system prompt is hundreds of stable lines, and finding the
+//! paragraph that moved by reading two of them side by side is not something
+//! a person does reliably. The differ itself is `stella-diff` — the crate the
+//! CLI's `inspect::diff` was extracted into so this route and the terminal
+//! share one implementation instead of a fourth acknowledged copy.
+//!
+//! Baseline semantics mirror `crates/stella-cli/src/inspect.rs`
+//! (`resolve_baseline`), because a reader who has scripted against one surface
+//! must recognise the other:
+//!
+//! - `prev` / `first` search **same-role** calls over the **whole session**,
+//!   oldest execution first — a system prompt is byte-stable inside one
+//!   execution by design (the prompt-cache invariant), so the only place it
+//!   can drift is across turns, and stopping at the execution boundary would
+//!   report "no change" for exactly the comparison worth making.
+//! - A role's first call has no predecessor, so `prev`/`first` resolve to
+//!   `prompt` — the raw submitted bytes — and the payload reports the base it
+//!   actually used, never just the one requested.
+//!
+//! Documents are rendered from **full** bodies: the transcript clip exists so
+//! a drawer stays light, but a diff over clipped bodies would report the
+//! elision point as a change, which is a lie about the prompt.
+
+use rusqlite::Connection;
+use serde_json::{Value, json};
+
+use crate::db::{DbError, is_missing_schema};
+use crate::sent_context::{Preimages, journal_payloads, manifest_entries, reconstruct};
+
+/// Context lines framing each hunk — the same default `stella inspect --diff`
+/// and `git diff` use.
+const DEFAULT_CONTEXT: usize = 3;
+
+/// One recorded call's coordinates plus the role the baseline search matches
+/// on. The execution id travels with the coordinates because a baseline can
+/// live in an earlier turn, which is an earlier execution.
+struct CallRef {
+    execution_id: i64,
+    turn: i64,
+    step: i64,
+    call_seq: i64,
+    role: String,
+}
+
+impl CallRef {
+    /// How this call is named in a `---`/`+++` label. The execution id is
+    /// printed only when it differs from the call being inspected, so a
+    /// same-turn comparison stays terse and a cross-turn one is unmistakable.
+    fn label(&self, relative_to: i64) -> String {
+        let prefix = if self.execution_id == relative_to {
+            String::new()
+        } else {
+            format!("execution {} · ", self.execution_id)
+        };
+        format!(
+            "{prefix}turn {} · step {} · seq {} ({})",
+            self.turn, self.step, self.call_seq, self.role
+        )
+    }
+}
+
+/// The `/api/execution-context-diff` payload: the diff between the addressed
+/// call's reconstruction and its resolved baseline, in the exact JSON shape
+/// `stella inspect --diff --format json` emits (`base`, `base_label`,
+/// `target_label`, `scope`, `changed`, `added`, `removed`, `minimal`,
+/// `hunks[]`) plus `found`/`note` for the observatory's missing-is-a-state
+/// posture.
+pub(crate) fn payload(
+    conn: &Connection,
+    id: i64,
+    turn: i64,
+    step: i64,
+    call_seq: i64,
+    base: &str,
+    only: &str,
+) -> Result<Value, DbError> {
+    let entries = manifest_entries(conn, id, turn, step, call_seq)?;
+    if entries.is_empty() {
+        return Ok(json!({
+            "execution_id": id,
+            "found": false,
+            "note": format!(
+                "no receipt for execution {id} turn {turn} step {step} call-seq {call_seq}"
+            ),
+        }));
+    }
+    let role = call_role_at(conn, id, turn, step, call_seq)?.unwrap_or_else(|| "worker".into());
+    let target = CallRef {
+        execution_id: id,
+        turn,
+        step,
+        call_seq,
+        role,
+    };
+    let preimages = Preimages::index(&journal_payloads(conn, id)?);
+    let target_doc = render_document(&reconstruct(&entries, &preimages, true), only);
+
+    let baseline = resolve_baseline(conn, &target, base, only)?;
+    let diff = stella_diff::unified_diff(&baseline.document, &target_doc, DEFAULT_CONTEXT);
+    Ok(json!({
+        "execution_id": id,
+        "found": true,
+        "base": baseline.kind,
+        "base_label": baseline.label,
+        "target_label": target.label(id),
+        "scope": scope_label(only),
+        "changed": diff.changed(),
+        "added": diff.added,
+        "removed": diff.removed,
+        "minimal": diff.minimal,
+        "hunks": diff.hunks.iter().map(|h| json!({
+            "old_start": h.old_start,
+            "old_count": h.old_count,
+            "new_start": h.new_start,
+            "new_count": h.new_count,
+            "lines": h.lines.iter().map(|l| json!({
+                "op": l.op.tag(),
+                "text": l.text,
+            })).collect::<Vec<_>>(),
+        })).collect::<Vec<_>>(),
+    }))
+}
+
+/// The earlier state the diff is taken against, resolved to bytes plus the
+/// label and kind the payload reports.
+struct Baseline {
+    label: String,
+    kind: &'static str,
+    document: String,
+}
+
+/// Mirror of the CLI's `resolve_baseline`: same-role, whole-session, oldest
+/// first; `prev` takes the last earlier call, `first` the earliest; nothing
+/// earlier resolves to the submitted prompt.
+fn resolve_baseline(
+    conn: &Connection,
+    target: &CallRef,
+    base: &str,
+    only: &str,
+) -> Result<Baseline, DbError> {
+    if base == "prompt" {
+        return prompt_baseline(conn, target.execution_id);
+    }
+    let mut turns = session_executions(conn, target.execution_id)?;
+    if turns.is_empty() {
+        turns.push(target.execution_id);
+    }
+    let mut earlier: Vec<CallRef> = Vec::new();
+    for turn_execution in turns {
+        // Later turns cannot be a baseline for an earlier one; ids are
+        // allocated in submission order.
+        if turn_execution > target.execution_id {
+            break;
+        }
+        for call in recorded_calls_of(conn, turn_execution)? {
+            if call.execution_id == target.execution_id
+                && (call.turn, call.step, call.call_seq)
+                    >= (target.turn, target.step, target.call_seq)
+            {
+                break;
+            }
+            if call.role == target.role {
+                earlier.push(call);
+            }
+        }
+    }
+    let picked = if base == "first" {
+        earlier.into_iter().next()
+    } else {
+        earlier.pop()
+    };
+    // Nothing of this role ran before: the only prior state that ever existed
+    // is what the user typed, so that is the honest baseline rather than an
+    // error or an empty diff.
+    let Some(previous) = picked else {
+        return prompt_baseline(conn, target.execution_id);
+    };
+    let entries = manifest_entries(
+        conn,
+        previous.execution_id,
+        previous.turn,
+        previous.step,
+        previous.call_seq,
+    )?;
+    let preimages = Preimages::index(&journal_payloads(conn, previous.execution_id)?);
+    Ok(Baseline {
+        label: previous.label(target.execution_id),
+        kind: if base == "first" { "first" } else { "prev" },
+        document: render_document(&reconstruct(&entries, &preimages, true), only),
+    })
+}
+
+/// The raw submitted prompt as a baseline — what the user actually typed,
+/// before Stella assembled anything around it.
+fn prompt_baseline(conn: &Connection, id: i64) -> Result<Baseline, DbError> {
+    let prompt = match conn.query_row("SELECT prompt FROM executions WHERE id = ?1", [id], |r| {
+        r.get::<_, String>(0)
+    }) {
+        Ok(prompt) => prompt,
+        Err(rusqlite::Error::QueryReturnedNoRows) => String::new(),
+        Err(e) if is_missing_schema(&e) => String::new(),
+        Err(e) => return Err(e.into()),
+    };
+    Ok(Baseline {
+        label: "prompt as submitted".to_string(),
+        kind: "prompt",
+        document: prompt,
+    })
+}
+
+/// Every turn of the conversation containing `id`, oldest first — the same
+/// walk `stella_store::Store::session_executions` performs, hand-written in
+/// the observatory's established style. Empty when the execution has no
+/// session (a one-shot `stella run` is its own session).
+fn session_executions(conn: &Connection, id: i64) -> Result<Vec<i64>, DbError> {
+    let sql = "SELECT id FROM executions
+               WHERE session_id IS NOT NULL AND session_id <> ''
+                 AND session_id = (SELECT session_id FROM executions WHERE id = ?1)
+               ORDER BY id ASC";
+    let mut stmt = match conn.prepare(sql) {
+        Ok(stmt) => stmt,
+        Err(e) if is_missing_schema(&e) => return Ok(Vec::new()),
+        Err(e) => return Err(e.into()),
+    };
+    let mapped = stmt.query_map([id], |r| r.get::<_, i64>(0))?;
+    let mut out = Vec::new();
+    for row in mapped {
+        out.push(row?);
+    }
+    Ok(out)
+}
+
+/// One execution's recorded calls in wire order, as [`CallRef`]s.
+fn recorded_calls_of(conn: &Connection, execution_id: i64) -> Result<Vec<CallRef>, DbError> {
+    let sql = "SELECT turn_instance, step, call_seq, call_role
+               FROM step_receipt WHERE execution_id = ?1
+               ORDER BY turn_instance, step, call_seq";
+    let mut stmt = match conn.prepare(sql) {
+        Ok(stmt) => stmt,
+        Err(e) if is_missing_schema(&e) => return Ok(Vec::new()),
+        Err(e) => return Err(e.into()),
+    };
+    let mapped = stmt.query_map([execution_id], |r| {
+        Ok(CallRef {
+            execution_id,
+            turn: r.get(0)?,
+            step: r.get(1)?,
+            call_seq: r.get(2)?,
+            role: r.get(3)?,
+        })
+    })?;
+    let mut out = Vec::new();
+    for row in mapped {
+        out.push(row?);
+    }
+    Ok(out)
+}
+
+/// The addressed call's role from its receipt, `None` when the receipt row is
+/// missing (the manifest can outlive a pre-receipt store's header row).
+fn call_role_at(
+    conn: &Connection,
+    id: i64,
+    turn: i64,
+    step: i64,
+    call_seq: i64,
+) -> Result<Option<String>, DbError> {
+    let sql = "SELECT call_role FROM step_receipt
+               WHERE execution_id = ?1 AND turn_instance = ?2 AND step = ?3 AND call_seq = ?4";
+    match conn.query_row(sql, [id, turn, step, call_seq], |r| r.get::<_, String>(0)) {
+        Ok(role) => Ok(Some(role)),
+        Err(rusqlite::Error::QueryReturnedNoRows) => Ok(None),
+        Err(e) if is_missing_schema(&e) => Ok(None),
+        Err(e) => Err(e.into()),
+    }
+}
+
+/// Flatten a reconstruction into the line-oriented document the diff
+/// compares — the same shape as the CLI's `render_document`: messages headed
+/// by role alone, never by index (an inserted message would renumber every
+/// header after it, and a diff reporting forty changed lines because one
+/// number shifted is worse than no diff at all).
+fn render_document(recon: &Value, only: &str) -> String {
+    let mut out = String::new();
+    let Some(messages) = recon.get("messages").and_then(Value::as_array) else {
+        return out;
+    };
+    for message in messages {
+        let role = message.get("role").and_then(Value::as_str).unwrap_or("");
+        if only != "all" && role != only {
+            continue;
+        }
+        if !out.is_empty() {
+            out.push('\n');
+        }
+        out.push_str(&format!("── {role} ──\n"));
+        out.push_str(message.get("body").and_then(Value::as_str).unwrap_or(""));
+        out.push('\n');
+    }
+    out
+}
+
+/// The scope wording `stella inspect --diff` reports for `--only`, mirrored so
+/// scripted readers see one vocabulary.
+fn scope_label(only: &str) -> String {
+    if only == "all" {
+        "all messages".to_string()
+    } else {
+        format!("{only} messages")
+    }
+}
diff --git a/crates/stella-observatory/src/db.rs b/crates/stella-observatory/src/db.rs
index 5b74ae6a8..ce23e1ce8 100644
--- a/crates/stella-observatory/src/db.rs
+++ b/crates/stella-observatory/src/db.rs
@@ -454,6 +454,49 @@ impl Observatory {
         }
     }
 
+    /// What changed between two model calls (#1511) — the diff between the
+    /// addressed call's reconstruction and its resolved baseline, in the JSON
+    /// shape `stella inspect --diff --format json` emits. The fold lives in
+    /// `context_diff`, which documents the baseline semantics it mirrors.
+    pub fn execution_context_diff(
+        &self,
+        id: i64,
+        turn: i64,
+        step: i64,
+        call_seq: i64,
+        base: &str,
+        only: &str,
+    ) -> Result<Value, DbError> {
+        match self.store() {
+            Some(conn) => crate::context_diff::payload(&conn, id, turn, step, call_seq, base, only),
+            None => Ok(crate::sent_context::no_receipts(id)),
+        }
+    }
+
+    /// Every session of this workspace: the registry's live/crashed view
+    /// joined with the store's per-session rollups. The fold lives in
+    /// `sessions`, which documents the two-source merge.
+    pub fn sessions(&self) -> Result<Value, DbError> {
+        crate::sessions::sessions(self.store().as_ref(), &self.workspace_root)
+    }
+
+    /// One session drilled to its turns, plus the session-scoped surfaces the
+    /// per-turn view can't show (skills, MCP traffic, task board, PRs,
+    /// lessons, memory writes).
+    pub fn session(&self, id: &str) -> Result<Value, DbError> {
+        crate::sessions::session_detail(self.store().as_ref(), &self.workspace_root, id)
+    }
+
+    /// One execution's behavioural tendencies (retries, loop detections,
+    /// compactions, policy verdicts), folded from its journal slice — the
+    /// fourth sanctioned `events` read; see `sessions::execution_tendencies`.
+    pub fn execution_tendencies(&self, id: i64) -> Result<Value, DbError> {
+        let Some(conn) = self.store() else {
+            return Ok(Value::Null);
+        };
+        crate::sessions::execution_tendencies(&conn, id)
+    }
+
     /// Per-(provider, model) usage — the same rows `stella stats` prints,
     /// same semantics (`resolved` = outcome `completed`, `off-grid` = local).
     pub fn models(&self) -> Result<Value, DbError> {
@@ -557,17 +600,33 @@ impl Observatory {
             .into_iter()
             .map(|(name, mut agg)| {
                 agg.durations.sort_unstable();
+                // Nearest-rank over the already-sorted window — the vector is
+                // materialized for the p50 anyway, so the tail percentiles
+                // cost two more indexed reads, not another scan.
+                let rank = |num: usize, den: usize| {
+                    agg.durations
+                        .get((agg.durations.len() * num / den).min(agg.durations.len() - 1))
+                        .copied()
+                        .unwrap_or(0)
+                };
                 let p50 = agg
                     .durations
                     .get(agg.durations.len() / 2)
                     .copied()
                     .unwrap_or(0);
+                let (p90, p99) = if agg.durations.is_empty() {
+                    (0, 0)
+                } else {
+                    (rank(9, 10), rank(99, 100))
+                };
                 let max = agg.durations.last().copied().unwrap_or(0);
                 json!({
                     "name": name,
                     "calls": agg.calls,
                     "errors": agg.errors,
                     "p50_ms": p50,
+                    "p90_ms": p90,
+                    "p99_ms": p99,
                     "max_ms": max,
                     "bytes_out": agg.bytes_out,
                 })
diff --git a/crates/stella-observatory/src/lib.rs b/crates/stella-observatory/src/lib.rs
index c646b3f17..c912734c5 100644
--- a/crates/stella-observatory/src/lib.rs
+++ b/crates/stella-observatory/src/lib.rs
@@ -43,12 +43,14 @@
 
 mod accept;
 mod codegraph;
+mod context_diff;
 mod db;
 mod fsview;
 mod global;
 mod live;
 mod self_driving;
 mod sent_context;
+mod sessions;
 
 use accept::{AcceptAction, AcceptBackoff};
 use std::net::SocketAddr;
@@ -260,6 +262,68 @@ pub fn respond(workspace_root: &Path, path: &str) -> Response {
                 None => return Response::error("400 Bad Request", "missing ?id=<execution id>"),
             }
         }
+        // What changed between two model calls (#1511): the diff between one
+        // call's reconstructed context and an earlier state of the session —
+        // `stella inspect --diff`, served. `base` picks the earlier state
+        // (`prev`|`first`|`prompt`); `only` narrows to one role's messages.
+        "/api/execution-context-diff" => {
+            match query_param(query, "id").and_then(|v| v.parse::<i64>().ok()) {
+                Some(id) => {
+                    let base = query_param(query, "base").unwrap_or_else(|| "prev".into());
+                    let only = query_param(query, "only").unwrap_or_else(|| "all".into());
+                    if !matches!(base.as_str(), "prev" | "first" | "prompt") {
+                        return Response::error(
+                            "400 Bad Request",
+                            "base must be prev|first|prompt",
+                        );
+                    }
+                    if !matches!(
+                        only.as_str(),
+                        "all" | "system" | "user" | "assistant" | "tool"
+                    ) {
+                        return Response::error(
+                            "400 Bad Request",
+                            "only must be all|system|user|assistant|tool",
+                        );
+                    }
+                    obs.execution_context_diff(
+                        id,
+                        query_param(query, "turn")
+                            .and_then(|v| v.parse::<i64>().ok())
+                            .unwrap_or(0),
+                        query_param(query, "step")
+                            .and_then(|v| v.parse::<i64>().ok())
+                            .unwrap_or(0),
+                        query_param(query, "call_seq")
+                            .and_then(|v| v.parse::<i64>().ok())
+                            .unwrap_or(0),
+                        &base,
+                        &only,
+                    )
+                }
+                None => return Response::error("400 Bad Request", "missing ?id=<execution id>"),
+            }
+        }
+        // The sessions plane: the registry's live/crashed view joined with
+        // the store's per-session rollups, and one session drilled to its
+        // turns. The deeper layers (transcript, sent context) stay on the
+        // per-execution routes above — that is the sanctioned shape for
+        // `events` reads, and the drawer the session view drills into
+        // already speaks them.
+        "/api/sessions" => obs.sessions(),
+        "/api/session" => match query_param(query, "id") {
+            Some(id) => obs.session(&id),
+            None => return Response::error("400 Bad Request", "missing ?id=<session id>"),
+        },
+        // One execution's behavioural tendencies — retries, loop detections,
+        // compactions, policy verdicts — folded from its journal slice for
+        // the drawer's tendency strip.
+        "/api/execution-tendencies" => {
+            match query_param(query, "id").and_then(|v| v.parse::<i64>().ok()) {
+                Some(id) => obs.execution_tendencies(id),
+                None => return Response::error("400 Bad Request", "missing ?id=<execution id>"),
+            }
+        }
         "/api/models" => obs.models(),
         "/api/tools" => obs.tools(),
         "/api/files" => obs.files(),
diff --git a/crates/stella-observatory/src/sent_context.rs b/crates/stella-observatory/src/sent_context.rs
index 7a92d8960..211bb602c 100644
--- a/crates/stella-observatory/src/sent_context.rs
+++ b/crates/stella-observatory/src/sent_context.rs
@@ -170,7 +170,7 @@ fn call_context(
 /// A `LEFT JOIN`, deliberately: a manifest citing a block that was never
 /// registered must come back as an entry with no `kind` — an unresolved block
 /// the reader is told about — rather than vanish from the wire order.
-fn manifest_entries(
+pub(crate) fn manifest_entries(
     conn: &Connection,
     id: i64,
     turn: i64,
@@ -217,7 +217,7 @@ fn manifest_entries(
 /// The third sanctioned read of `events`, on the same bargain as the other
 /// two: `execution_id`-first, which the store's `UNIQUE (execution_id, seq)`
 /// index serves directly, and only on a per-execution detail route.
-fn journal_payloads(conn: &Connection, id: i64) -> Result<Vec<String>, DbError> {
+pub(crate) fn journal_payloads(conn: &Connection, id: i64) -> Result<Vec<String>, DbError> {
     let sql = "SELECT payload FROM events
                WHERE execution_id = ?1
                  AND event_type IN ('tool_start', 'tool_result', 'text')
diff --git a/crates/stella-observatory/src/sessions.rs b/crates/stella-observatory/src/sessions.rs
new file mode 100644
index 000000000..6f2ee36f0
--- /dev/null
+++ b/crates/stella-observatory/src/sessions.rs
@@ -0,0 +1,977 @@
+//! The sessions view: the cross-process session registry joined with the
+//! store's per-session telemetry rollups — the list a reader drills from
+//! session → turn → step → tool call.
+//!
+//! Two sources, deliberately kept apart until the final merge:
+//!
+//! - **The registry** (`~/.stella/sessions/<id>.json`, one JSON file per
+//!   session — see `stella_store::sessions` for the write side) carries what
+//!   only the owning process knew: title, summary, status, liveness. Read
+//!   here the same way the deck's SESSIONS overlay reads it: sweep the
+//!   directory, skip what doesn't parse, and downgrade a live status whose
+//!   owning pid is gone to `error` ("crashed") without rewriting the dead
+//!   process's file.
+//! - **The store** (`executions.session_id`, stamped since schema v8, served
+//!   by the `executions_by_session` index) carries what actually happened:
+//!   turns, tokens, spend, tool traffic, files, skills, MCP calls.
+//!
+//! A session can exist in either source alone. A just-started session has a
+//! registry record and no stamped executions yet; a pruned registry loses the
+//! record while the store still remembers every turn. Both shapes are listed
+//! — `registry: false` marks the latter, with the session's first prompt
+//! standing in for the title the registry no longer holds.
+//!
+//! The turn-by-turn drill stays per-execution by design: a session's deeper
+//! layers (transcript, sent context, prompt diff) are served by the existing
+//! `/api/execution-journal` and `/api/execution-context` routes one execution
+//! at a time, which is the sanctioned shape for `events` reads — a
+//! session-wide transcript query would be exactly the cross-execution `WHERE`
+//! the journal rule forbids (see `crate::db::Observatory::execution_journal`).
+
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+
+use rusqlite::Connection;
+use serde_json::{Value, json};
+
+use crate::db::{DbError, is_missing_schema, merge};
+
+/// Sessions returned by [`sessions`]. Same shape of reasoning as
+/// `MAX_LISTED_EXECUTIONS`: the page re-fetches the list on every refresh, so
+/// an unbounded listing would make each poll pay for the machine's whole
+/// session history; 200 sessions is months of work on a busy workspace.
+const MAX_LISTED_SESSIONS: usize = 200;
+
+/// Registry files swept per request. A bound, not a limit anyone should
+/// reach — the registry is pruned opportunistically by the deck driver, so a
+/// directory this full means something else went wrong, and a synchronous
+/// request must not stall on it.
+const MAX_REGISTRY_RECORDS: usize = 500;
+
+/// Newest turns returned by [`session_detail`]. The drill fetches one
+/// session, not the store's history, but a perpetual session (a self-driving
+/// loop's, say) can accumulate turns without bound; the payload says when it
+/// clipped (`turns_truncated`) instead of presenting the window as the whole.
+const MAX_SESSION_TURNS: usize = 500;
+
+/// `~/.stella/sessions` — where every session announces itself.
+///
+/// Resolved through `stella-home` rather than re-derived, so `STELLA_HOME`
+/// moves the observatory's view and the registry's writes together.
+fn registry_dir() -> PathBuf {
+    stella_home::data_dir().join("sessions")
+}
+
+/// Whether `pid` is a live process. Unix: `kill(pid, 0)` (EPERM still means
+/// alive). Elsewhere: assume alive (no downgrade — better to show a stale
+/// in-progress row than to mislabel a live session as crashed).
+///
+/// An **acknowledged copy** of `stella_store::sessions::pid_alive`, the same
+/// bargain `sent_context`'s reconstruction fold takes: this crate re-reads
+/// artifacts instead of linking the crates that write them (see the crate
+/// README's acknowledged-copies paragraph). The semantics being copied are
+/// load-bearing: a pid that does not fit `pid_t` must read as dead — an `as`
+/// cast would wrap it negative, and `kill(-N, 0)` probes process *group* N,
+/// which can spuriously report alive.
+fn pid_alive(pid: u32) -> bool {
+    #[cfg(unix)]
+    {
+        let Ok(pid) = libc::pid_t::try_from(pid) else {
+            return false;
+        };
+        if pid == 0 {
+            return false;
+        }
+        let rc = unsafe { libc::kill(pid, 0) };
+        rc == 0 || std::io::Error::last_os_error().raw_os_error() == Some(libc::EPERM)
+    }
+    #[cfg(not(unix))]
+    {
+        let _ = pid;
+        true
+    }
+}
+
+/// A registry id that is safe to use as a filename. Session ids are minted
+/// `ses-<ms>-<pid>`, so anything outside `[A-Za-z0-9._-]` (or starting with a
+/// dot) is not an id — and this is the one place a client-supplied string
+/// meets the filesystem, so the check is a gate, not a formality.
+fn safe_session_id(id: &str) -> bool {
+    !id.is_empty()
+        && !id.starts_with('.')
+        && id
+            .chars()
+            .all(|c| c.is_ascii_alphanumeric() || matches!(c, '-' | '_' | '.'))
+}
+
+/// Whether a registry record's `workspace` names the workspace being served.
+///
+/// Canonicalized when the recorded path still exists (so a symlinked checkout
+/// matches), string-compared when it doesn't (a deleted workspace's sessions
+/// should still not leak into another project's list).
+fn same_workspace(recorded: &str, canon_root: &Path) -> bool {
+    if recorded.is_empty() {
+        return false;
+    }
+    match std::fs::canonicalize(recorded) {
+        Ok(c) => c == canon_root,
+        Err(_) => Path::new(recorded) == canon_root,
+    }
+}
+
+/// The status a record is *presented* with: a live claim whose owning process
+/// is gone reads as `error` ("crashed"), everything else as stored. Returns
+/// `(status, live, crashed)` — mirroring `SessionRegistry::presented_status`.
+fn presented_status(record: &Value) -> (String, bool, bool) {
+    let stored = record
+        .get("status")
+        .and_then(Value::as_str)
+        .unwrap_or("error");
+    let claims_live = matches!(stored, "in_progress" | "needs_input");
+    let pid = record
+        .get("pid")
+        .and_then(Value::as_u64)
+        .and_then(|p| u32::try_from(p).ok())
+        .unwrap_or(0);
+    if claims_live && !pid_alive(pid) {
+        ("error".to_string(), false, true)
+    } else {
+        (stored.to_string(), claims_live, false)
+    }
+}
+
+/// The registry records belonging to `workspace_root`, plus how many files
+/// were present but unusable (reported, never silently dropped — a damaged
+/// record very likely still has a recoverable sidecar behind it).
+fn registry_records(workspace_root: &Path) -> (Vec<Value>, usize) {
+    let Ok(entries) = std::fs::read_dir(registry_dir()) else {
+        return (Vec::new(), 0);
+    };
+    let canon_root =
+        std::fs::canonicalize(workspace_root).unwrap_or_else(|_| workspace_root.to_path_buf());
+    let mut records = Vec::new();
+    let mut damaged = 0;
+    for entry in entries.flatten().take(MAX_REGISTRY_RECORDS) {
+        let path = entry.path();
+        if path.extension().and_then(|e| e.to_str()) != Some("json") {
+            continue;
+        }
+        let Ok(text) = std::fs::read_to_string(&path) else {
+            damaged += 1;
+            continue;
+        };
+        let Ok(record) = serde_json::from_str::<Value>(&text) else {
+            damaged += 1;
+            continue;
+        };
+        if !record.is_object() {
+            damaged += 1;
+            continue;
+        }
+        let workspace = record
+            .get("workspace")
+            .and_then(Value::as_str)
+            .unwrap_or_default();
+        if same_workspace(workspace, &canon_root) {
+            records.push(record);
+        }
+    }
+    (records, damaged)
+}
+
+/// One registry record read by exact id — the detail view's half of
+/// [`registry_records`], without the directory sweep.
+fn registry_record(id: &str) -> Option<Value> {
+    if !safe_session_id(id) {
+        return None;
+    }
+    let text = std::fs::read_to_string(registry_dir().join(format!("{id}.json"))).ok()?;
+    serde_json::from_str::<Value>(&text)
+        .ok()
+        .filter(Value::is_object)
+}
+
+/// The start-time milliseconds a session id itself carries (`ses-<ms>-<pid>`),
+/// used as the sort key for sessions whose registry record is gone. Zero for
+/// an id in any other shape — those sort last, which is where a session with
+/// no other timestamp belongs.
+fn ms_from_id(id: &str) -> u64 {
+    id.split('-')
+        .nth(1)
+        .and_then(|s| s.parse().ok())
+        .unwrap_or(0)
+}
+
+/// The store's per-session rollup: one aggregate row per stamped session over
+/// the three tables every store has carried since long before `session_id`
+/// existed (telemetry, tool_calls, files_touched). Skills and MCP counts ride
+/// in separately ([`per_session_counts`]) so a store predating those tables
+/// blanks those two numbers, not the whole list.
+fn session_rollups(conn: &Connection) -> Result<BTreeMap<String, Value>, DbError> {
+    let sql = format!(
+        "SELECT e.session_id,
+                count(*),
+                count(*) FILTER (WHERE e.outcome = 'completed'),
+                coalesce(sum(e.cost_usd), 0),
+                min(e.started_at), max(coalesce(e.finished_at, e.started_at)),
+                min(e.id), max(e.id),
+                coalesce(sum(t.input_tokens), 0),
+                coalesce(sum(t.output_tokens), 0),
+                coalesce(sum(t.cache_read_tokens), 0),
+                coalesce(sum(t.cache_miss_tokens), 0),
+                coalesce(sum(t.retries), 0),
+                coalesce(sum(t.duration_ms), 0),
+                coalesce(sum(tc.calls), 0),
+                coalesce(sum(tc.errors), 0),
+                coalesce(sum(ft.files), 0),
+                coalesce(sum(ft.added), 0),
+                coalesce(sum(ft.removed), 0)
+         FROM executions e
+         LEFT JOIN (SELECT execution_id,
+                           sum(input_tokens)      AS input_tokens,
+                           sum(output_tokens)     AS output_tokens,
+                           sum(cache_read_tokens) AS cache_read_tokens,
+                           sum(cache_miss_tokens) AS cache_miss_tokens,
+                           sum(retries)           AS retries,
+                           sum(duration_ms)       AS duration_ms
+                    FROM telemetry GROUP BY execution_id) t
+           ON t.execution_id = e.id
+         LEFT JOIN (SELECT execution_id, count(*) AS calls,
+                           count(*) FILTER (WHERE error <> '') AS errors
+                    FROM tool_calls GROUP BY execution_id) tc
+           ON tc.execution_id = e.id
+         LEFT JOIN (SELECT execution_id, count(*) AS files,
+                           sum(lines_added)  AS added,
+                           sum(lines_removed) AS removed
+                    FROM files_touched GROUP BY execution_id) ft
+           ON ft.execution_id = e.id
+         WHERE e.session_id IS NOT NULL AND e.session_id <> ''
+         GROUP BY e.session_id
+         ORDER BY max(e.id) DESC
+         LIMIT {MAX_LISTED_SESSIONS}"
+    );
+    let mut stmt = match conn.prepare(&sql) {
+        Ok(stmt) => stmt,
+        Err(e) if is_missing_schema(&e) => return Ok(BTreeMap::new()),
+        Err(e) => return Err(e.into()),
+    };
+    let mapped = stmt.query_map([], |r| {
+        Ok((
+            r.get::<_, String>(0)?,
+            json!({
+                "turns": r.get::<_, i64>(1)?,
+                "resolved": r.get::<_, i64>(2)?,
+                "cost_usd": r.get::<_, f64>(3)?,
+                "first_started_at": r.get::<_, String>(4)?,
+                "last_activity_at": r.get::<_, String>(5)?,
+                "first_id": r.get::<_, i64>(6)?,
+                "last_id": r.get::<_, i64>(7)?,
+                "input_tokens": r.get::<_, i64>(8)?,
+                "output_tokens": r.get::<_, i64>(9)?,
+                "cache_read_tokens": r.get::<_, i64>(10)?,
+                "cache_miss_tokens": r.get::<_, i64>(11)?,
+                "retries": r.get::<_, i64>(12)?,
+                "model_ms": r.get::<_, i64>(13)?,
+                "tool_calls": r.get::<_, i64>(14)?,
+                "tool_errors": r.get::<_, i64>(15)?,
+                "files_touched": r.get::<_, i64>(16)?,
+                "lines_added": r.get::<_, i64>(17)?,
+                "lines_removed": r.get::<_, i64>(18)?,
+            }),
+        ))
+    })?;
+    let mut out = BTreeMap::new();
+    for row in mapped {
+        let (id, rollup) = row?;
+        out.insert(id, rollup);
+    }
+    Ok(out)
+}
+
+/// The rollup shape for a session the store has no stamped turns for — every
+/// aggregate zero, so the page renders one row schema everywhere.
+fn empty_rollup() -> Value {
+    json!({
+        "turns": 0, "resolved": 0, "cost_usd": 0.0,
+        "first_started_at": "", "last_activity_at": "",
+        "first_id": 0, "last_id": 0,
+        "input_tokens": 0, "output_tokens": 0,
+        "cache_read_tokens": 0, "cache_miss_tokens": 0,
+        "retries": 0, "model_ms": 0,
+        "tool_calls": 0, "tool_errors": 0,
+        "files_touched": 0, "lines_added": 0, "lines_removed": 0,
+    })
+}
+
+/// Per-session counts from one younger table (`skill_usage`, `mcp_usage`),
+/// folded separately so a store predating the table degrades this number to
+/// zero instead of blanking the whole listing.
+fn per_session_counts(conn: &Connection, table: &str) -> Result<BTreeMap<String, i64>, DbError> {
+    let sql = format!(
+        "SELECT e.session_id, count(*)
+         FROM {table} u JOIN executions e ON e.id = u.execution_id
+         WHERE e.session_id IS NOT NULL AND e.session_id <> ''
+         GROUP BY e.session_id"
+    );
+    let mut stmt = match conn.prepare(&sql) {
+        Ok(stmt) => stmt,
+        Err(e) if is_missing_schema(&e) => return Ok(BTreeMap::new()),
+        Err(e) => return Err(e.into()),
+    };
+    let mapped = stmt.query_map([], |r| Ok((r.get::<_, String>(0)?, r.get::<_, i64>(1)?)))?;
+    let mut out = BTreeMap::new();
+    for row in mapped {
+        let (id, n) = row?;
+        out.insert(id, n);
+    }
+    Ok(out)
+}
+
+/// Each stamped session's first prompt — the title stand-in for sessions
+/// whose registry record has been pruned.
+fn first_prompts(conn: &Connection) -> Result<BTreeMap<String, String>, DbError> {
+    let sql = "SELECT e.session_id, e.prompt FROM executions e
+               WHERE e.session_id IS NOT NULL AND e.session_id <> ''
+                 AND e.id = (SELECT min(id) FROM executions f
+                             WHERE f.session_id = e.session_id)";
+    let mut stmt = match conn.prepare(sql) {
+        Ok(stmt) => stmt,
+        Err(e) if is_missing_schema(&e) => return Ok(BTreeMap::new()),
+        Err(e) => return Err(e.into()),
+    };
+    let mapped = stmt.query_map([], |r| Ok((r.get::<_, String>(0)?, r.get::<_, String>(1)?)))?;
+    let mut out = BTreeMap::new();
+    for row in mapped {
+        let (id, prompt) = row?;
+        out.insert(id, clip(prompt, 140));
+    }
+    Ok(out)
+}
+
+/// Cap a string at `max` chars on a char boundary, appending an ellipsis.
+fn clip(s: String, max: usize) -> String {
+    if s.chars().count() <= max {
+        return s;
+    }
+    let mut out: String = s.chars().take(max).collect();
+    out.push('…');
+    out
+}
+
+/// The `/api/sessions` payload: every session of this workspace, registry
+/// and store merged, newest activity first.
+pub(crate) fn sessions(conn: Option<&Connection>, workspace_root: &Path) -> Result<Value, DbError> {
+    let (mut rollups, skill_counts, mcp_counts, prompts) = match conn {
+        Some(conn) => (
+            session_rollups(conn)?,
+            per_session_counts(conn, "skill_usage")?,
+            per_session_counts(conn, "mcp_usage")?,
+            first_prompts(conn)?,
+        ),
+        None => Default::default(),
+    };
+    let (records, damaged) = registry_records(workspace_root);
+    let mut rows = Vec::new();
+    for record in records {
+        let id = record
+            .get("id")
+            .and_then(Value::as_str)
+            .unwrap_or_default()
+            .to_string();
+        if id.is_empty() {
+            continue;
+        }
+        let (status, live, crashed) = presented_status(&record);
+        let mut row = json!({
+            "id": id,
+            "registry": true,
+            "title": record.get("title").and_then(Value::as_str).unwrap_or(""),
+            "summary": record.get("summary").and_then(Value::as_str).unwrap_or(""),
+            "status": status,
+            "live": live,
+            "crashed": crashed,
+            "supervised": record.get("supervisor").is_some_and(|s| !s.is_null()),
+            "started_at_ms": record.get("started_at_ms").and_then(Value::as_u64).unwrap_or(0),
+            "updated_at_ms": record.get("updated_at_ms").and_then(Value::as_u64).unwrap_or(0),
+        });
+        let rollup = rollups.remove(&id).unwrap_or_else(empty_rollup);
+        merge(&mut row, rollup);
+        row["skill_uses"] = json!(skill_counts.get(&id).copied().unwrap_or(0));
+        row["mcp_calls"] = json!(mcp_counts.get(&id).copied().unwrap_or(0));
+        rows.push(row);
+    }
+    // Sessions the registry has already pruned but the store still remembers:
+    // no status to present, first prompt standing in for the lost title.
+    for (id, rollup) in rollups {
+        let ms = ms_from_id(&id);
+        let mut row = json!({
+            "id": id,
+            "registry": false,
+            "title": prompts.get(&id).cloned().unwrap_or_default(),
+            "summary": "",
+            "status": Value::Null,
+            "live": false,
+            "crashed": false,
+            "supervised": false,
+            "started_at_ms": ms,
+            "updated_at_ms": ms,
+        });
+        let skills = skill_counts.get(&id).copied().unwrap_or(0);
+        let mcp = mcp_counts.get(&id).copied().unwrap_or(0);
+        merge(&mut row, rollup);
+        row["skill_uses"] = json!(skills);
+        row["mcp_calls"] = json!(mcp);
+        rows.push(row);
+    }
+    rows.sort_by_key(|r| {
+        std::cmp::Reverse(r.get("updated_at_ms").and_then(Value::as_u64).unwrap_or(0))
+    });
+    rows.truncate(MAX_LISTED_SESSIONS);
+    Ok(json!({ "sessions": rows, "damaged": damaged }))
+}
+
+/// The `/api/session?id=` payload: one session drilled to its turns — each
+/// with its own tool/skill/MCP/receipt counts, ready to hand off to the
+/// per-execution drawer — plus the session-scoped surfaces the turn view
+/// can't show: skills and MCP traffic aggregated, memory citations, the task
+/// board, and pull requests.
+pub(crate) fn session_detail(
+    conn: Option<&Connection>,
+    _workspace_root: &Path,
+    id: &str,
+) -> Result<Value, DbError> {
+    let record = registry_record(id);
+    let registry = record.as_ref().map(|record| {
+        let (status, live, crashed) = presented_status(record);
+        json!({
+            "title": record.get("title").and_then(Value::as_str).unwrap_or(""),
+            "summary": record.get("summary").and_then(Value::as_str).unwrap_or(""),
+            "workspace": record.get("workspace").and_then(Value::as_str).unwrap_or(""),
+            "status": status,
+            "live": live,
+            "crashed": crashed,
+            "supervised": record.get("supervisor").is_some_and(|s| !s.is_null()),
+            "started_at_ms": record.get("started_at_ms").and_then(Value::as_u64).unwrap_or(0),
+            "updated_at_ms": record.get("updated_at_ms").and_then(Value::as_u64).unwrap_or(0),
+            "exploring": record.get("exploring").cloned().unwrap_or_else(|| json!([])),
+        })
+    });
+    let mut out = json!({
+        "id": id,
+        "registry": registry,
+        "turns": [],
+        "turns_truncated": false,
+        "skills": [],
+        "mcp": [],
+        "agents": [],
+        "memory": [],
+        "tasks": [],
+        "pull_requests": [],
+    });
+    let Some(conn) = conn else {
+        out["found"] = json!(out["registry"] != Value::Null);
+        return Ok(out);
+    };
+    if !safe_session_id(id) {
+        out["found"] = json!(false);
+        return Ok(out);
+    }
+    let mut turns = session_turns(conn, id)?;
+    let truncated = turns.len() >= MAX_SESSION_TURNS;
+    // Fetched newest-first so the cap keeps recent work; replayed oldest-first
+    // because that is the order the session happened in.
+    turns.reverse();
+    fold_turn_extras(conn, id, &mut turns)?;
+    out["found"] = json!(out["registry"] != Value::Null || !turns.is_empty());
+    out["turns"] = Value::Array(turns);
+    out["turns_truncated"] = json!(truncated);
+    out["skills"] = Value::Array(session_group(
+        conn,
+        id,
+        "SELECT u.skill, count(*), max(u.version), max(u.ts)
+         FROM skill_usage u
+         WHERE u.execution_id IN (SELECT id FROM executions WHERE session_id = ?1)
+         GROUP BY u.skill ORDER BY count(*) DESC",
+        |r| {
+            Ok(json!({
+                "skill": r.get::<_, String>(0)?,
+                "uses": r.get::<_, i64>(1)?,
+                "version": r.get::<_, i64>(2)?,
+                "last_used": r.get::<_, String>(3)?,
+            }))
+        },
+    )?);
+    out["mcp"] = Value::Array(session_group(
+        conn,
+        id,
+        "SELECT u.server, u.tool, count(*), max(u.called_at_ms)
+         FROM mcp_usage u
+         WHERE u.execution_id IN (SELECT id FROM executions WHERE session_id = ?1)
+         GROUP BY u.server, u.tool ORDER BY count(*) DESC",
+        |r| {
+            Ok(json!({
+                "server": r.get::<_, String>(0)?,
+                "tool": r.get::<_, String>(1)?,
+                "calls": r.get::<_, i64>(2)?,
+                "last_called_at_ms": r.get::<_, i64>(3)?,
+            }))
+        },
+    )?);
+    out["agents"] = Value::Array(session_group(
+        conn,
+        id,
+        "SELECT u.agent, count(*), max(u.ts)
+         FROM agent_uses u
+         WHERE u.execution_id IN (SELECT id FROM executions WHERE session_id = ?1)
+         GROUP BY u.agent ORDER BY count(*) DESC",
+        |r| {
+            Ok(json!({
+                "agent": r.get::<_, String>(0)?,
+                "uses": r.get::<_, i64>(1)?,
+                "last_used": r.get::<_, String>(2)?,
+            }))
+        },
+    )?);
+    out["memory"] = Value::Array(session_group(
+        conn,
+        id,
+        "SELECT c.memory_id, count(*), avg(c.useful_score),
+                count(*) FILTER (WHERE c.truthful = 0)
+         FROM memory_citations c
+         WHERE c.execution_id IN (SELECT id FROM executions WHERE session_id = ?1)
+         GROUP BY c.memory_id ORDER BY count(*) DESC",
+        |r| {
+            Ok(json!({
+                "memory_id": r.get::<_, String>(0)?,
+                "citations": r.get::<_, i64>(1)?,
+                "avg_useful_score": r.get::<_, Option<f64>>(2)?,
+                "untruthful": r.get::<_, i64>(3)?,
+            }))
+        },
+    )?);
+    out["tasks"] = Value::Array(session_group(
+        conn,
+        id,
+        "SELECT task_id, subject, status, owner, updated_at
+         FROM tasks WHERE session_id = ?1
+         ORDER BY CAST(task_id AS INTEGER) ASC, task_id ASC",
+        |r| {
+            Ok(json!({
+                "task_id": r.get::<_, String>(0)?,
+                "subject": r.get::<_, String>(1)?,
+                "status": r.get::<_, String>(2)?,
+                "owner": r.get::<_, Option<String>>(3)?,
+                "updated_at_ms": r.get::<_, i64>(4)?,
+            }))
+        },
+    )?);
+    out["pull_requests"] = Value::Array(session_group(
+        conn,
+        id,
+        "SELECT url, number, status, ci_status, updated_at
+         FROM pull_requests WHERE session_id = ?1
+         ORDER BY updated_at DESC, url ASC",
+        |r| {
+            Ok(json!({
+                "url": r.get::<_, String>(0)?,
+                "number": r.get::<_, Option<i64>>(1)?,
+                "status": r.get::<_, String>(2)?,
+                "ci_status": r.get::<_, Option<String>>(3)?,
+                "updated_at_ms": r.get::<_, i64>(4)?,
+            }))
+        },
+    )?);
+    // The self-improvement residue this session left behind: mined lessons
+    // (reflections whose execution the session stamped — a NULL execution_id
+    // is a cross-turn lesson and deliberately stays out of any one session),
+    // and durable memory writes, recovered from the `save_memory` tool-call
+    // log rather than a table that does not exist.
+    out["lessons"] = Value::Array(session_group(
+        conn,
+        id,
+        "SELECT r.kind, r.content, r.domains, r.occurred_at, r.execution_id
+         FROM reflections r JOIN executions e ON e.id = r.execution_id
+         WHERE e.session_id = ?1 ORDER BY r.occurred_at DESC LIMIT 100",
+        |r| {
+            Ok(json!({
+                "kind": r.get::<_, String>(0)?,
+                "content": r.get::<_, String>(1)?,
+                "domains": r.get::<_, String>(2)?,
+                "occurred_at": r.get::<_, i64>(3)?,
+                "execution_id": r.get::<_, i64>(4)?,
+            }))
+        },
+    )?);
+    let mut writes = session_group(
+        conn,
+        id,
+        "SELECT tc.execution_id, tc.args_json, tc.ok, tc.ts FROM tool_calls tc
+         WHERE tc.name = 'save_memory'
+           AND tc.execution_id IN (SELECT id FROM executions WHERE session_id = ?1)
+         ORDER BY tc.ts ASC",
+        |r| {
+            Ok(json!({
+                "execution_id": r.get::<_, i64>(0)?,
+                "args_json": r.get::<_, String>(1)?,
+                "ok": r.get::<_, i64>(2)? != 0,
+                "ts": r.get::<_, String>(3)?,
+            }))
+        },
+    )?;
+    for write in &mut writes {
+        let slug = write
+            .get("args_json")
+            .and_then(Value::as_str)
+            .and_then(|args| serde_json::from_str::<Value>(args).ok())
+            .and_then(|args| {
+                args.get("slug")
+                    .or_else(|| args.get("title"))
+                    .or_else(|| args.get("name"))
+                    .and_then(Value::as_str)
+                    .map(str::to_string)
+            })
+            .unwrap_or_default();
+        write["slug"] = json!(slug);
+        // The full memory text rode in on args_json; the page needs the slug
+        // and the fact of the write, not a second copy of the memory.
+        write.as_object_mut().map(|o| o.remove("args_json"));
+    }
+    out["memory_writes"] = Value::Array(writes);
+    Ok(out)
+}
+
+/// The wire tags of every behavioural event [`execution_tendencies`] folds.
+/// Spelled once: the filter and the fold must agree, and the tags are the
+/// serde snake_case of `stella_protocol::AgentEvent` variant names.
+const TENDENCY_EVENT_TYPES: &str = "'retry','retries_exhausted','loop_detected',\
+     'budget_denied','compaction','policy_decision','speculation_discarded',\
+     'steered','provider_fallback','usage_incomplete'";
+
+/// One execution's behavioural tendencies — retries, loop detections,
+/// compactions, policy verdicts — folded from its slice of the `events`
+/// journal (the store projects none of these into a queryable table yet).
+///
+/// This is a sanctioned `events` read in the same sense as
+/// `Observatory::execution_journal`: the filter is `execution_id`-first,
+/// served directly by the store's `UNIQUE (execution_id, seq)` index. A
+/// cross-execution tendencies view would need a store-side projection, not a
+/// wider `WHERE` here.
+pub(crate) fn execution_tendencies(conn: &Connection, id: i64) -> Result<Value, DbError> {
+    let sql = format!(
+        "SELECT event_type, payload FROM events
+         WHERE execution_id = ?1 AND event_type IN ({TENDENCY_EVENT_TYPES})
+         ORDER BY seq ASC"
+    );
+    let mut stmt = match conn.prepare(&sql) {
+        Ok(stmt) => stmt,
+        Err(e) if is_missing_schema(&e) => return Ok(empty_tendencies(id)),
+        Err(e) => return Err(e.into()),
+    };
+    let mapped = stmt.query_map([id], |r| {
+        Ok((r.get::<_, String>(0)?, r.get::<_, String>(1)?))
+    })?;
+    let mut out = empty_tendencies(id);
+    let mut loops: BTreeMap<String, i64> = BTreeMap::new();
+    let mut policy: BTreeMap<String, i64> = BTreeMap::new();
+    for row in mapped {
+        let (event_type, payload) = row?;
+        let payload: Value = serde_json::from_str(&payload).unwrap_or(Value::Null);
+        match event_type.as_str() {
+            "retry" => bump(&mut out, "retries"),
+            "retries_exhausted" => bump(&mut out, "retries_exhausted"),
+            "loop_detected" => {
+                let kind = payload
+                    .get("kind")
+                    .and_then(Value::as_str)
+                    .unwrap_or("unknown")
+                    .to_string();
+                *loops.entry(kind).or_insert(0) += 1;
+                if payload.get("aborted").and_then(Value::as_bool) == Some(true) {
+                    bump(&mut out, "loop_aborts");
+                }
+            }
+            "budget_denied" => bump(&mut out, "budget_denied"),
+            "compaction" => {
+                bump(&mut out, "compactions");
+                let before = payload.get("before_tokens").and_then(Value::as_i64);
+                let after = payload.get("after_tokens").and_then(Value::as_i64);
+                if let (Some(before), Some(after)) = (before, after) {
+                    let reclaimed = out["tokens_reclaimed"].as_i64().unwrap_or(0);
+                    out["tokens_reclaimed"] = json!(reclaimed + (before - after).max(0));
+                }
+            }
+            "policy_decision" => {
+                let kind = payload
+                    .get("kind")
+                    .and_then(Value::as_str)
+                    .unwrap_or("unknown")
+                    .to_string();
+                *policy.entry(kind).or_insert(0) += 1;
+            }
+            "speculation_discarded" => bump(&mut out, "speculation_discarded"),
+            "steered" => bump(&mut out, "steered"),
+            "provider_fallback" => bump(&mut out, "provider_fallback"),
+            "usage_incomplete" => bump(&mut out, "usage_incomplete"),
+            _ => {}
+        }
+    }
+    out["loops"] = json!(loops);
+    out["policy"] = json!(policy);
+    Ok(out)
+}
+
+/// The all-zero tendencies payload — what a store with no journal (or no
+/// `events` table at all) reports, and the base the fold counts into.
+fn empty_tendencies(id: i64) -> Value {
+    json!({
+        "execution_id": id,
+        "retries": 0,
+        "retries_exhausted": 0,
+        "loops": {},
+        "loop_aborts": 0,
+        "budget_denied": 0,
+        "compactions": 0,
+        "tokens_reclaimed": 0,
+        "policy": {},
+        "speculation_discarded": 0,
+        "steered": 0,
+        "provider_fallback": 0,
+        "usage_incomplete": 0,
+    })
+}
+
+/// Increment one integer counter field on the tendencies payload.
+fn bump(out: &mut Value, key: &str) {
+    let n = out[key].as_i64().unwrap_or(0);
+    out[key] = json!(n + 1);
+}
+
+/// The session's turns from the three long-lived tables, newest first (the
+/// caller reverses after capping). Younger per-turn attachments — skills,
+/// MCP servers, receipt counts, the reflection verdict — ride in afterwards
+/// through [`fold_turn_extras`].
+fn session_turns(conn: &Connection, id: &str) -> Result<Vec<Value>, DbError> {
+    let sql = format!(
+        "SELECT e.id, e.kind, e.prompt, e.provider, e.model, e.outcome,
+                e.cost_usd, e.started_at, e.finished_at,
+                coalesce(t.steps, 0), coalesce(t.input_tokens, 0),
+                coalesce(t.output_tokens, 0), coalesce(t.cache_read_tokens, 0),
+                coalesce(t.cache_miss_tokens, 0), coalesce(t.retries, 0),
+                coalesce(t.duration_ms, 0),
+                coalesce(tc.calls, 0), coalesce(tc.errors, 0),
+                coalesce(ft.files, 0), coalesce(ft.added, 0), coalesce(ft.removed, 0)
+         FROM executions e
+         LEFT JOIN (SELECT execution_id, count(*) AS steps,
+                           sum(input_tokens)      AS input_tokens,
+                           sum(output_tokens)     AS output_tokens,
+                           sum(cache_read_tokens) AS cache_read_tokens,
+                           sum(cache_miss_tokens) AS cache_miss_tokens,
+                           sum(retries)           AS retries,
+                           sum(duration_ms)       AS duration_ms
+                    FROM telemetry GROUP BY execution_id) t
+           ON t.execution_id = e.id
+         LEFT JOIN (SELECT execution_id, count(*) AS calls,
+                           count(*) FILTER (WHERE error <> '') AS errors
+                    FROM tool_calls GROUP BY execution_id) tc
+           ON tc.execution_id = e.id
+         LEFT JOIN (SELECT execution_id, count(*) AS files,
+                           sum(lines_added)  AS added,
+                           sum(lines_removed) AS removed
+                    FROM files_touched GROUP BY execution_id) ft
+           ON ft.execution_id = e.id
+         WHERE e.session_id = ?1
+         ORDER BY e.id DESC
+         LIMIT {MAX_SESSION_TURNS}"
+    );
+    let mut stmt = match conn.prepare(&sql) {
+        Ok(stmt) => stmt,
+        Err(e) if is_missing_schema(&e) => return Ok(Vec::new()),
+        Err(e) => return Err(e.into()),
+    };
+    let mapped = stmt.query_map([id], |r| {
+        Ok(json!({
+            "id": r.get::<_, i64>(0)?,
+            "kind": r.get::<_, String>(1)?,
+            "prompt": r.get::<_, String>(2)?,
+            "provider": r.get::<_, String>(3)?,
+            "model": r.get::<_, String>(4)?,
+            "outcome": r.get::<_, Option<String>>(5)?,
+            "cost_usd": r.get::<_, f64>(6)?,
+            "started_at": r.get::<_, String>(7)?,
+            "finished_at": r.get::<_, Option<String>>(8)?,
+            "steps": r.get::<_, i64>(9)?,
+            "input_tokens": r.get::<_, i64>(10)?,
+            "output_tokens": r.get::<_, i64>(11)?,
+            "cache_read_tokens": r.get::<_, i64>(12)?,
+            "cache_miss_tokens": r.get::<_, i64>(13)?,
+            "retries": r.get::<_, i64>(14)?,
+            "model_ms": r.get::<_, i64>(15)?,
+            "tool_calls": r.get::<_, i64>(16)?,
+            "tool_errors": r.get::<_, i64>(17)?,
+            "files_touched": r.get::<_, i64>(18)?,
+            "lines_added": r.get::<_, i64>(19)?,
+            "lines_removed": r.get::<_, i64>(20)?,
+        }))
+    })?;
+    let mut out = Vec::new();
+    for row in mapped {
+        out.push(row?);
+    }
+    // Prompts are carried whole from the store but a listing does not need a
+    // multi-kilobyte goal; the drawer shows the full text.
+    for row in &mut out {
+        if let Some(prompt) = row.get("prompt").and_then(Value::as_str) {
+            let clipped = clip(prompt.to_string(), 240);
+            row["prompt"] = json!(clipped);
+        }
+    }
+    Ok(out)
+}
+
+/// Attach the younger tables' per-turn facts to already-fetched turn rows:
+/// skills applied, MCP servers called, receipt counts (whether the sent-
+/// context drill has anything to show), and the reflection verdict. Each
+/// query degrades alone, so an older store loses one column, not the view.
+fn fold_turn_extras(conn: &Connection, id: &str, turns: &mut [Value]) -> Result<(), DbError> {
+    let mut skills: BTreeMap<i64, Vec<String>> = BTreeMap::new();
+    for (execution, skill) in session_pairs(
+        conn,
+        id,
+        "SELECT u.execution_id, u.skill FROM skill_usage u
+         WHERE u.execution_id IN (SELECT id FROM executions WHERE session_id = ?1)
+         ORDER BY u.execution_id, u.ts",
+    )? {
+        skills.entry(execution).or_default().push(skill);
+    }
+    let mut mcp: BTreeMap<i64, Vec<String>> = BTreeMap::new();
+    for (execution, server) in session_pairs(
+        conn,
+        id,
+        "SELECT DISTINCT u.execution_id, u.server FROM mcp_usage u
+         WHERE u.execution_id IN (SELECT id FROM executions WHERE session_id = ?1)
+         ORDER BY u.execution_id, u.server",
+    )? {
+        mcp.entry(execution).or_default().push(server);
+    }
+    let mut receipts: BTreeMap<i64, i64> = BTreeMap::new();
+    for row in session_group(
+        conn,
+        id,
+        "SELECT r.execution_id, count(*) FROM step_receipt r
+         WHERE r.execution_id IN (SELECT id FROM executions WHERE session_id = ?1)
+         GROUP BY r.execution_id",
+        |r| Ok(json!([r.get::<_, i64>(0)?, r.get::<_, i64>(1)?])),
+    )? {
+        if let (Some(execution), Some(n)) = (
+            row.get(0).and_then(Value::as_i64),
+            row.get(1).and_then(Value::as_i64),
+        ) {
+            receipts.insert(execution, n);
+        }
+    }
+    let mut reflections: BTreeMap<i64, Value> = BTreeMap::new();
+    for row in session_group(
+        conn,
+        id,
+        "SELECT execution_id, delivered, self_rating FROM execution_reflection
+         WHERE execution_id IN (SELECT id FROM executions WHERE session_id = ?1)",
+        |r| {
+            Ok(json!([
+                r.get::<_, i64>(0)?,
+                json!({
+                    "delivered": r.get::<_, Option<i64>>(1)?,
+                    "self_rating": r.get::<_, Option<i64>>(2)?,
+                })
+            ]))
+        },
+    )? {
+        if let (Some(execution), Some(verdict)) =
+            (row.get(0).and_then(Value::as_i64), row.get(1).cloned())
+        {
+            reflections.insert(execution, verdict);
+        }
+    }
+    for turn in turns.iter_mut() {
+        let Some(execution) = turn.get("id").and_then(Value::as_i64) else {
+            continue;
+        };
+        turn["skills"] = json!(skills.get(&execution).cloned().unwrap_or_default());
+        turn["mcp_servers"] = json!(mcp.get(&execution).cloned().unwrap_or_default());
+        turn["receipts"] = json!(receipts.get(&execution).copied().unwrap_or(0));
+        turn["reflection"] = reflections.get(&execution).cloned().unwrap_or(Value::Null);
+    }
+    Ok(())
+}
+
+/// Run one session-bound query collecting every row; a missing table or
+/// column degrades to `[]` — the same bargain `crate::db::collect_rows`
+/// strikes, with the session id bound as the parameter.
+fn session_group<F>(conn: &Connection, id: &str, sql: &str, map: F) -> Result<Vec<Value>, DbError>
+where
+    F: Fn(&rusqlite::Row<'_>) -> rusqlite::Result<Value>,
+{
+    let mut stmt = match conn.prepare(sql) {
+        Ok(stmt) => stmt,
+        Err(e) if is_missing_schema(&e) => return Ok(Vec::new()),
+        Err(e) => return Err(e.into()),
+    };
+    let mapped = stmt.query_map([id], map)?;
+    let mut out = Vec::new();
+    for row in mapped {
+        out.push(row?);
+    }
+    Ok(out)
+}
+
+/// [`session_group`] for `(execution_id, text)` pairs — the shape both
+/// per-turn attachment queries share.
+fn session_pairs(conn: &Connection, id: &str, sql: &str) -> Result<Vec<(i64, String)>, DbError> {
+    let mut stmt = match conn.prepare(sql) {
+        Ok(stmt) => stmt,
+        Err(e) if is_missing_schema(&e) => return Ok(Vec::new()),
+        Err(e) => return Err(e.into()),
+    };
+    let mapped = stmt.query_map([id], |r| Ok((r.get::<_, i64>(0)?, r.get::<_, String>(1)?)))?;
+    let mut out = Vec::new();
+    for row in mapped {
+        out.push(row?);
+    }
+    Ok(out)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn session_ids_that_could_escape_the_registry_dir_are_rejected() {
+        assert!(safe_session_id("ses-1722900000000-4242"));
+        assert!(!safe_session_id(""));
+        assert!(!safe_session_id("../../etc/passwd"));
+        assert!(!safe_session_id("a/b"));
+        assert!(!safe_session_id("a\\b"));
+        assert!(!safe_session_id(".hidden"));
+    }
+
+    #[test]
+    fn the_id_mint_time_is_recovered_and_junk_sorts_last() {
+        assert_eq!(ms_from_id("ses-1722900000000-4242"), 1_722_900_000_000);
+        assert_eq!(ms_from_id("not-an-id"), 0);
+        assert_eq!(ms_from_id(""), 0);
+    }
+
+    #[test]
+    fn a_live_claim_with_a_dead_pid_presents_as_crashed() {
+        // A pid that cannot fit pid_t reads as dead on unix, so the record
+        // downgrades; the stored terminal status is passed through untouched.
+        let record = json!({ "status": "in_progress", "pid": u32::MAX });
+        let (status, live, crashed) = presented_status(&record);
+        if cfg!(unix) {
+            assert_eq!(status, "error");
+            assert!(!live);
+            assert!(crashed);
+        }
+        let done = json!({ "status": "complete", "pid": 0 });
+        assert_eq!(presented_status(&done), ("complete".into(), false, false));
+    }
+}
diff --git a/crates/stella-observatory/src/tests.rs b/crates/stella-observatory/src/tests.rs
index 7f281247e..3ef474493 100644
--- a/crates/stella-observatory/src/tests.rs
+++ b/crates/stella-observatory/src/tests.rs
@@ -613,6 +613,10 @@ fn empty_workspace_degrades_to_empty_payloads_not_errors() {
         "/api/execution-journal?id=1&after_seq=0",
         "/api/execution-context?id=1",
         "/api/execution-context?id=1&turn=0&step=1&call_seq=0",
+        "/api/sessions",
+        "/api/session?id=ses-1700000000000-424242",
+        "/api/execution-tendencies?id=1",
+        "/api/execution-context-diff?id=1",
         "/api/models",
         "/api/tools",
         "/api/files",
diff --git a/crates/stella-observatory/tests/schema_conformance.rs b/crates/stella-observatory/tests/schema_conformance.rs
index 1b5f87205..09add810f 100644
--- a/crates/stella-observatory/tests/schema_conformance.rs
+++ b/crates/stella-observatory/tests/schema_conformance.rs
@@ -37,7 +37,9 @@ use std::path::Path;
 
 use sha2::{Digest, Sha256};
 use stella_observatory::respond;
-use stella_protocol::{AgentEvent, ContextFrameRef, ProviderShare, ToolCall, ToolOutput};
+use stella_protocol::{
+    AgentEvent, ContextFrameRef, ProviderShare, TaskItem, TaskStatus, ToolCall, ToolOutput,
+};
 use stella_store::{
     AgentUseRow, ContextBlockRow, ExecutionReflectionRow, FileTouchRow, ManifestBlockRow,
     McpUsageRow, MemoryCitationRow, ReflectionRow, SkillUsageRow, StepManifestRow, Store,
@@ -49,6 +51,15 @@ use stella_store::{
 /// else in the store, and reconstructing it is the whole point of the route.
 const SYSTEM_PROMPT: &str = "you are stella, and you are careful";
 
+/// The session the seeded execution is stamped with — what `/api/sessions`
+/// lists and `/api/session` drills. Shaped like a real minted id
+/// (`ses-<ms>-<pid>`) because the sessions view recovers a sort key from it.
+const SESSION_ID: &str = "ses-1700000000000-424242";
+
+/// The one line the second turn's system prefix gained — what the prompt-diff
+/// witness expects to see as the sole `+` line (#1511).
+const DRIFT_LINE: &str = "and be bold about it";
+
 /// Every `/api/*` route the router serves, paired with the JSON pointer that
 /// must resolve to seeded (non-empty) data.
 ///
@@ -70,6 +81,16 @@ const ROUTES: &[(&str, Option<&str>)] = &[
         "/api/execution-context?id=1&turn=0&step=1&call_seq=0",
         Some("/context/messages/0/role"),
     ),
+    ("/api/sessions", Some("/sessions/0/id")),
+    (
+        "/api/session?id=ses-1700000000000-424242",
+        Some("/turns/0/id"),
+    ),
+    ("/api/execution-tendencies?id=1", Some("/retries")),
+    (
+        "/api/execution-context-diff?id=2&turn=0&step=1&call_seq=0",
+        Some("/hunks/0/lines/0/op"),
+    ),
     ("/api/models", Some("/0/provider")),
     ("/api/tools", Some("/0/name")),
     ("/api/files", Some("/0/path")),
@@ -133,6 +154,9 @@ fn real_store_workspace() -> tempfile::TempDir {
     let completed = store
         .begin_execution("run", "add a function", "zai", "glm-5.2")
         .expect("begin");
+    store
+        .set_execution_session(completed, SESSION_ID)
+        .expect("session stamp");
     // Tool calls arrive as events and are projected from them — seeding the
     // `tool_calls` table any other way would test a write path production
     // does not use.
@@ -149,7 +173,58 @@ fn real_store_workspace() -> tempfile::TempDir {
             .record_event(completed, seq as u64, &event)
             .expect("tool event");
     }
+    // Two behavioural events for the tendencies fold: a retry and a steer-
+    // stage loop detection. Seeded as events because that is the only place
+    // production writes them — no projection exists.
+    store
+        .record_event(
+            completed,
+            2,
+            &AgentEvent::Retry {
+                attempt: 1,
+                reason: "rate limited".into(),
+            },
+        )
+        .expect("retry event");
+    store
+        .record_event(
+            completed,
+            3,
+            &AgentEvent::LoopDetected {
+                turn_instance: 0,
+                kind: "exact_repeat".into(),
+                pattern: vec!["read_file".into()],
+                repeats: 3,
+                evidence: "same call three times".into(),
+                aborted: false,
+            },
+        )
+        .expect("loop event");
     seed_receipt(&store, completed, &call, &output);
+    store
+        .record_task_board(
+            completed,
+            Some(SESSION_ID),
+            &[TaskItem {
+                id: "1".into(),
+                subject: "add the function".into(),
+                description: None,
+                status: TaskStatus::Completed,
+                owner: Some("lead".into()),
+            }],
+            1_700_000_000_000,
+        )
+        .expect("task board");
+    store
+        .upsert_pull_request(
+            Some(SESSION_ID),
+            "https://github.com/example/repo/pull/7",
+            Some(7),
+            "open",
+            Some("passing"),
+            1_700_000_000_000,
+        )
+        .expect("pull request");
     store
         .record_telemetry(
             completed,
@@ -258,7 +333,25 @@ fn real_store_workspace() -> tempfile::TempDir {
         .finish_execution(completed, "completed", 0.03)
         .expect("finish");
 
-    // A second, unfinished execution: the observatory must render a run that
+    // A second turn of the same session whose system prefix gained exactly
+    // one line — the drift `/api/execution-context-diff` exists to name
+    // (#1511). Two byte-identical worker calls, so `prev` inside this turn is
+    // an honest "no change" while `prev` across the turn boundary names the
+    // line that moved.
+    let drifted = store
+        .begin_execution("run", "add another function", "zai", "glm-5.2")
+        .expect("begin drifted");
+    store
+        .set_execution_session(drifted, SESSION_ID)
+        .expect("session stamp 2");
+    let drifted_prompt = format!("{SYSTEM_PROMPT}\n{DRIFT_LINE}");
+    seed_system_receipt(&store, drifted, 1, &drifted_prompt);
+    seed_system_receipt(&store, drifted, 2, &drifted_prompt);
+    store
+        .finish_execution(drifted, "completed", 0.01)
+        .expect("finish drifted");
+
+    // A last, unfinished execution: the observatory must render a run that
     // is still in flight (outcome NULL, finished_at NULL) without failing.
     store
         .begin_execution("goal", "make tests pass", "local", "llama")
@@ -266,6 +359,55 @@ fn real_store_workspace() -> tempfile::TempDir {
     dir
 }
 
+/// One worker call whose whole context is a single system-prefix block — the
+/// smallest receipt that makes a call diffable. The block is a gap kind, so
+/// its bytes are stored locally, exactly as the engine stores them.
+fn seed_system_receipt(store: &Store, execution_id: i64, step: u64, system: &str) {
+    store
+        .record_context_block(
+            execution_id,
+            &ContextBlockRow {
+                block_id: "blk_sys_drift".into(),
+                kind: "system_prefix".into(),
+                origin_turn: 0,
+                origin_step: 0,
+                call_id: None,
+                memory_id: None,
+                token_cost: Some(48),
+                content_digest: digest(system),
+                citation_label: None,
+                content: Some(system.into()),
+            },
+        )
+        .expect("drifted system block");
+    store
+        .record_step_manifest(
+            execution_id,
+            &StepManifestRow {
+                turn_instance: 0,
+                step,
+                call_seq: 0,
+                provider: "zai".into(),
+                model: "glm-5.2".into(),
+                call_role: "worker".into(),
+                effective_budget_tokens: 136_363,
+                calibration_factor: 1.1,
+                estimated_input_tokens: 48,
+                compiled_frame_id: None,
+                frame_hash: None,
+                blocks: vec![ManifestBlockRow {
+                    block_id: "blk_sys_drift".into(),
+                    cache_zone: "stable_prefix".into(),
+                    token_cost: Some(48),
+                    resident_since_step: 0,
+                    message_index: 0,
+                    call_id: None,
+                }],
+            },
+        )
+        .expect("drifted manifest");
+}
+
 /// One recorded model call's context receipt: the block registry plus the
 /// ordered manifest `/api/execution-context` reconstructs from (#1475).
 ///
@@ -717,3 +859,80 @@ fn every_route_survives_a_store_older_than_this_build() {
         "the columns that DO exist still report: {cursor}"
     );
 }
+
+/// The #1511 witness: two calls of the same role whose system prefixes differ
+/// by one line produce exactly one hunk naming that line, and a
+/// byte-identical pair reports `changed: false`. Fails before the route
+/// exists (404), and fails if the baseline search stops at the execution
+/// boundary — the drift here is *across* turns, which is the only place a
+/// byte-stable system prompt can drift.
+#[test]
+fn context_diff_names_the_moved_line_and_reports_identity_honestly() {
+    let workspace = real_store_workspace();
+    let root: &Path = workspace.path();
+
+    // Across the turn boundary: execution 2's first worker call against
+    // execution 1's — the same role, one line of drift, system scope.
+    let body = respond(
+        root,
+        "/api/execution-context-diff?id=2&turn=0&step=1&call_seq=0&base=prev&only=system",
+    )
+    .body;
+    let diff: serde_json::Value = serde_json::from_slice(&body).expect("diff json");
+    assert_eq!(diff["found"], true, "{diff}");
+    assert_eq!(diff["changed"], true, "{diff}");
+    assert_eq!(diff["base"], "prev", "{diff}");
+    assert_eq!(diff["minimal"], true, "{diff}");
+    assert_eq!(diff["added"], 1, "one inserted line, one addition: {diff}");
+    let hunks = diff["hunks"].as_array().expect("hunks");
+    assert_eq!(hunks.len(), 1, "one contiguous change, one hunk: {diff}");
+    let added: Vec<&str> = hunks[0]["lines"]
+        .as_array()
+        .expect("lines")
+        .iter()
+        .filter(|l| l["op"] == "add")
+        .filter_map(|l| l["text"].as_str())
+        .collect();
+    assert_eq!(added, vec![DRIFT_LINE], "the diff names the moved line");
+    assert!(
+        diff["base_label"]
+            .as_str()
+            .unwrap_or_default()
+            .contains("execution 1"),
+        "a cross-turn baseline is unmistakable: {diff}"
+    );
+
+    // Inside the turn: step 2 against step 1, byte-identical by construction.
+    let body = respond(
+        root,
+        "/api/execution-context-diff?id=2&turn=0&step=2&call_seq=0&base=prev&only=system",
+    )
+    .body;
+    let same: serde_json::Value = serde_json::from_slice(&body).expect("diff json");
+    assert_eq!(
+        same["changed"], false,
+        "byte-identical is not a change: {same}"
+    );
+    assert_eq!(same["base"], "prev", "{same}");
+    assert!(
+        !same["base_label"]
+            .as_str()
+            .unwrap_or_default()
+            .contains("execution"),
+        "a same-turn baseline stays terse: {same}"
+    );
+
+    // A role's first call has no predecessor: the resolved base is reported
+    // as `prompt`, never silently claimed to be `prev`.
+    let body = respond(
+        root,
+        "/api/execution-context-diff?id=1&turn=0&step=1&call_seq=0&base=prev",
+    )
+    .body;
+    let first: serde_json::Value = serde_json::from_slice(&body).expect("diff json");
+    assert_eq!(
+        first["base"], "prompt",
+        "prev on a first call resolves: {first}"
+    );
+    assert_eq!(first["base_label"], "prompt as submitted", "{first}");
+}