mixdog 0.9.147 → 0.9.148

package/src/runtime/shared/webhook-session-run.mjs

@@ -37,11 +37,14 @@ function webhookRoute(modelRef) {
   throw new Error('webhook run has no model: set one on the endpoint or configure maintenance.webhook');
 }
 
-export async function runWebhookSession({ name, model = null, prompt, cwd = null, workflow = null, attachments = null, delivery = null }) {
+export async function runWebhookSession({ name, model = null, prompt, cwd = null, workflow = null, attachments = null, delivery = null, signal = null }) {
   const endpoint = String(name || '').trim();
   const body = String(prompt || '').trim();
   if (!endpoint) throw new Error('runWebhookSession: endpoint name required');
   if (!body) throw new Error(`webhook "${endpoint}" has no prompt body`);
+  // The dispatcher's cancellation (delivery timeout) has to reach the run
+  // itself: an already-cancelled dispatch must not even create a session.
+  if (signal?.aborted) throw signal.reason ?? new Error('webhook dispatch aborted');
   const route = webhookRoute(model);
   const projectCwd = cwd ? String(cwd) : null;
   const session = createSession({
@@ -65,6 +68,17 @@ export async function runWebhookSession({ name, model = null, prompt, cwd = null
   // read as the user-authored intent rather than payload noise.
   // Stored attachments ride along as composer-style content parts.
   const content = automationPromptContent(body, attachments);
-  const result = await askSession(session.id, content, null, null, projectCwd || undefined);
+  // askOpts.signal is the parent-abort link: it is cascaded onto the turn
+  // controller, so aborting it stops the in-flight provider/tool work instead
+  // of leaving a timed-out delivery's session running with live side effects.
+  const result = await askSession(
+    session.id,
+    content,
+    null,
+    null,
+    projectCwd || undefined,
+    undefined,
+    signal ? { signal } : {},
+  );
   return { sessionId: session.id, result: String(result?.content || '') };
 }

package/src/runtime/web-search/lib/http-fetch.mjs

@@ -303,16 +303,35 @@ function headersToCdpPairs(headers) {
  * Pinned fetch for a paused Chromium request: validate each hop, follow redirects,
  * return bytes for Fetch.fulfillRequest. Chromium never performs its own DNS/connect.
  */
+const ENTITY_HEADERS = new Set([
+  'content-type',
+  'content-length',
+  'content-encoding',
+  'content-language',
+  'content-location',
+])
+
+function withoutEntityHeaders(headers) {
+  const out = {}
+  for (const [name, value] of Object.entries(headers || {})) {
+    if (ENTITY_HEADERS.has(name.toLowerCase())) continue
+    out[name] = value
+  }
+  return out
+}
+
 export async function fetchPinnedForPausedRequest(url, { signal, method = 'GET', headers = {}, body } = {}) {
-  const upperMethod = (method || 'GET').toUpperCase()
+  let currentMethod = (method || 'GET').toUpperCase()
+  let currentHeaders = { ...headers }
+  let currentBody = body
   let currentUrl = url
   for (let hops = 0; ; hops++) {
     assertPublicUrl(currentUrl)
     const response = await pinnedFetch(currentUrl, {
       signal,
-      method: upperMethod,
-      headers,
-      body: hops === 0 ? body : undefined,
+      method: currentMethod,
+      headers: currentHeaders,
+      body: currentBody,
       redirect: 'manual',
     })
     if (REDIRECT_STATUSES.has(response.status)) {
@@ -325,6 +344,17 @@ export async function fetchPinnedForPausedRequest(url, { signal, method = 'GET',
         throw new Error(`Redirect ${response.status} without Location header`)
       }
       currentUrl = new URL(location, currentUrl).toString()
+      // Redirect method/body rewrite (fetch spec): 303 always, and 301/302 for
+      // anything other than GET/HEAD, become a bodyless GET. 307/308 preserve
+      // BOTH — so the body has to be replayed instead of dropped, which is what
+      // the previous `hops === 0` body gate did while keeping POST.
+      if (response.status === 303
+        || ((response.status === 301 || response.status === 302)
+          && currentMethod !== 'GET' && currentMethod !== 'HEAD')) {
+        currentMethod = 'GET'
+        currentBody = undefined
+        currentHeaders = withoutEntityHeaders(currentHeaders)
+      }
       continue
     }
     const respBody = await readBodyBytesWithCap(response, MAX_BODY_BYTES)

package/src/runtime/web-search/lib/state.mjs

@@ -14,10 +14,6 @@ function now() {
 function defaultState() {
   return {
     providers: {},
-    routingCache: {
-      rawBySite: {},
-      scrapeByHost: {},
-    },
   }
 }
 
@@ -74,15 +70,15 @@ export function loadUsageState() {
   if (_instance) return _instance
   const raw = readJson(USAGE_PATH, null)
   const def = defaultState()
-  const state = raw && typeof raw === 'object' ? {
-    ...def,
-    ...raw,
-    providers: { ...(raw.providers || {}) },
-    routingCache: {
-      rawBySite: { ...(def.routingCache.rawBySite), ...(raw.routingCache?.rawBySite || {}) },
-      scrapeByHost: { ...(def.routingCache.scrapeByHost), ...(raw.routingCache?.scrapeByHost || {}) },
-    },
-  } : def
+  let state = def
+  if (raw && typeof raw === 'object') {
+    // Drop the legacy `routingCache` (rawBySite/scrapeByHost) instead of
+    // carrying it forward: it has no consumers, and a plain `...raw` kept
+    // rewriting it back to disk on every flush.
+    const { routingCache: legacyRoutingCache, ...rest } = raw
+    state = { ...def, ...rest, providers: { ...(raw.providers || {}) } }
+    if (legacyRoutingCache !== undefined) scheduleUsageFlush(state)
+  }
   _instance = state
   activeUsageState = state
   return state
@@ -157,13 +153,17 @@ const PROVIDER_DISABLE_TTL_MS = {
   unknown: 0,
 }
 
-export function noteProviderFailure(state, provider, errorMessage, errorKind) {
+// `siteScoped` marks a failure that the FETCHED SITE produced (its 400/401/403/
+// 429), not a fault of the provider/extractor itself. Those statuses say
+// nothing about provider health, so they must never install the provider-wide
+// cooldown that would disable the extractor for every other host for 24h.
+export function noteProviderFailure(state, provider, errorMessage, errorKind, { siteScoped = false } = {}) {
   const payload = {
     error: errorMessage,
     lastUsedAt: now(),
     lastFailureAt: now(),
   }
-  const ttl = PROVIDER_DISABLE_TTL_MS[errorKind] ?? 0
+  const ttl = siteScoped ? 0 : (PROVIDER_DISABLE_TTL_MS[errorKind] ?? 0)
   if (ttl > 0) {
     payload.cooldownUntil = new Date(Date.now() + ttl).toISOString()
   }

package/src/runtime/web-search/lib/web-tools.mjs

@@ -292,9 +292,33 @@ function _notifyPoolWaiter() {
   if (next) next()
 }
 
-async function _acquirePoolSlot() {
+async function _acquirePoolSlot(signal) {
+  const abortError = () => signal?.reason || new Error('aborted')
+  // Waiting for a pool slot used to be uncancellable: an aborted tool call kept
+  // queueing until a slot freed, then launched a page nobody was waiting for.
   while (_poolActive >= PUPPETEER_POOL_MAX_PAGES) {
-    await new Promise((resolve) => _poolWaiters.push(resolve))
+    if (signal?.aborted) throw abortError()
+    await new Promise((resolve, reject) => {
+      let onAbort = null
+      const waiter = () => {
+        if (onAbort) signal.removeEventListener('abort', onAbort)
+        resolve()
+      }
+      if (signal) {
+        onAbort = () => {
+          const index = _poolWaiters.indexOf(waiter)
+          if (index >= 0) _poolWaiters.splice(index, 1)
+          reject(abortError())
+        }
+        signal.addEventListener('abort', onAbort, { once: true })
+      }
+      _poolWaiters.push(waiter)
+    })
+  }
+  if (signal?.aborted) {
+    // Woken but cancelled: pass the wake-up on so a live waiter isn't stranded.
+    _notifyPoolWaiter()
+    throw abortError()
   }
   _poolActive++
   _poolLastActivity = Date.now()
@@ -421,7 +445,7 @@ async function closeBrowserBounded(browser, timeoutMs = 5000) {
 }
 
 async function withPuppeteerPage(signal, fn) {
-  await _acquirePoolSlot()
+  await _acquirePoolSlot(signal)
   let browser
   let context
   let page
@@ -435,13 +459,26 @@ async function withPuppeteerPage(signal, fn) {
     }
     if (signal?.aborted) throw signal.reason || new Error('aborted')
     if (signal) {
-      onExternalAbort = () => { closeBrowserBounded(browser) }
+      // Tear down THIS call's page/context only. The browser is pooled and
+      // shared with every concurrent scrape, so closing it here killed
+      // unrelated in-flight pages.
+      onExternalAbort = () => {
+        try { void page?.close()?.catch?.(() => {}) } catch {}
+        try { void context?.close()?.catch?.(() => {}) } catch {}
+      }
       signal.addEventListener('abort', onExternalAbort, { once: true })
     }
+    // Creation is multi-step and awaits between each step: without a checkpoint
+    // per step an abort landing mid-setup was lost and the page ran anyway.
+    // (The finally below closes whatever was created by then.)
     context = await browser.createBrowserContext()
+    if (signal?.aborted) throw signal.reason || new Error('aborted')
     page = await context.newPage()
+    if (signal?.aborted) throw signal.reason || new Error('aborted')
     cdp = await page.createCDPSession()
+    if (signal?.aborted) throw signal.reason || new Error('aborted')
     await installPuppeteerSsrfGate(page, cdp, signal)
+    if (signal?.aborted) throw signal.reason || new Error('aborted')
     return await fn(page)
   } finally {
     if (onExternalAbort && signal) signal.removeEventListener('abort', onExternalAbort)
@@ -610,7 +647,11 @@ async function scrapeUrl(url, timeoutMs, usageState, signal) {
         throw err
       }
       const errorKind = classifyProviderError(error)
-      noteProviderFailure(usageState, extractor, message, errorKind)
+      // A status carried by the error came from the target page, so it is a
+      // property of that site — not of `readability`/`puppeteer`, which hold no
+      // credentials at all.
+      const siteScoped = Number.isFinite(Number(error?.status)) || /\bHTTP\s+\d{3}\b/.test(message)
+      noteProviderFailure(usageState, extractor, message, errorKind, { siteScoped })
     }
   }
 

package/src/session-runtime/context-status.mjs

@@ -12,7 +12,6 @@ import { SUMMARY_PREFIX } from '../runtime/agent/orchestrator/session/compact.mj
 import { hasUserConversationMessage } from '../runtime/agent/orchestrator/session/manager/prompt-utils.mjs';
 import {
   resolveGaugeContextTokens,
-  resolveCompactionPressureTokens,
   resolveWorkerCompactPolicy,
 } from '../runtime/agent/orchestrator/session/loop/compact-policy.mjs';
 import {
@@ -269,15 +268,8 @@ export function createContextStatus({
         ...resolveSessionCompactPolicy(session || {}, compactBoundaryTokens),
         tokenCalibration: providerTokenCalibration(session?.provider || route.provider),
       };
-    // Keep the user-facing gauge aligned to provider-visible context. The
-    // compaction branch retains its stricter pressure numerator separately.
-    const compactionPressureTokens = resolveCompactionPressureTokens(
-      messageSummary.estimatedTokens,
-      compactPolicy,
-      { messages, sessionRef: session },
-    );
-    // Same numerator the auto-compact trigger decides on, so the gauge reaches
-    // 100% exactly when compaction fires instead of still showing headroom.
+    // One canonical numerator drives the gauge, proactive compaction, and
+    // telemetry: provider usage plus only the growth after its aligned prefix.
     const usedTokens = resolveGaugeContextTokens(
       messageSummary.estimatedTokens,
       compactPolicy,
@@ -313,8 +305,8 @@ export function createContextStatus({
         triggerTokens: compactTriggerTokens || null,
         bufferTokens: Number.isFinite(compactBufferTokens) ? compactBufferTokens : null,
         bufferRatio: compactBufferRatio,
-        currentEstimatedTokens: compactionPressureTokens,
-        pressureTokens: compactionPressureTokens,
+        currentEstimatedTokens: usedTokens,
+        pressureTokens: usedTokens,
         reserveTokens: Math.max(0, Number(compactPolicy.configuredReserveTokens) || 0),
         lastApiRequestTokens: lastContextTokens || 0,
         lastApiRequestStale: lastUsageStale,

package/src/session-runtime/runtime-core.mjs

@@ -645,7 +645,26 @@ export async function createMixdogSessionRuntime({
     state: mcpState,
   });
   const hooksStartedAt = performance.now();
-  const hooks = createStandaloneHookBus({ dataDir: cfgMod.getPluginData() });
+  const hooks = createStandaloneHookBus({
+    dataDir: cfgMod.getPluginData(),
+    // `mcp_tool` hooks run against the SAME connected MCP servers this session
+    // uses. Without this runner every configured mcp_tool hook reported
+    // "handler type mcp_tool not configured", so the handler's timeout +
+    // cancellation path never ran in production. The hook's abort signal is
+    // forwarded so a timed-out hook cancels its tool call instead of leaving it
+    // holding an admission slot.
+    mcpToolRunner: async ({ name, args, signal }) => {
+      if (typeof mcpClient?.executeMcpTool !== 'function') {
+        throw new Error('MCP runtime is unavailable');
+      }
+      const result = await mcpClient.executeMcpTool(name, args ?? {}, {
+        scopeId: rt.mcpScopeId,
+        signal: signal || null,
+        ownerKey: `hook:${name}`,
+      });
+      return typeof result === 'string' ? result : String(result?.result ?? '');
+    },
+  });
   hooks.emit('runtime:start', { cwd: rt.currentCwd, provider: rt.route.provider, model: rt.route.model, toolMode: rt.mode });
   bootProfile('hooks:ready', { ms: (performance.now() - hooksStartedAt).toFixed(1) });
 

package/src/standalone/agent-dispatch-broker.mjs

@@ -1,4 +1,5 @@
 import { createFairCallScheduler } from './fair-call-scheduler.mjs';
+import { hashStructuredValue } from '../runtime/shared/json-metrics.mjs';
 
 const MEMORY_AGENTS = Object.freeze([
   'cycle1-agent',
@@ -13,6 +14,20 @@ function abortError(signal) {
     : new Error(String(signal?.reason || 'agent dispatch canceled'));
 }
 
+/** Identity of a dispatch PAYLOAD. A retry repeats it exactly; a caller that
+ *  reuses a callId for different work is issuing a different call. */
+function dispatchSignature(agent, params) {
+  try {
+    return hashStructuredValue({
+      agent,
+      prompt: String(params?.prompt ?? ''),
+      preset: params?.preset ?? null,
+      cwd: typeof params?.cwd === 'string' ? params.cwd : null,
+      timeout: Number.isFinite(Number(params?.timeout)) ? Number(params.timeout) : null,
+    });
+  } catch { return null; }
+}
+
 function awaitSharedPreparation(promise, signal) {
   if (!signal) return promise;
   if (signal.aborted) return Promise.reject(abortError(signal));
@@ -113,8 +128,24 @@ export function createAgentDispatchBroker({
     if (!prompt) return Promise.reject(new Error(`agent dispatch prompt required for "${agent}"`));
 
     const id = String(callId || `broker-${process.pid}-${++nextCallId}`);
+    const signature = dispatchSignature(agent, params);
     const existing = inFlight.get(id);
-    if (existing) return existing.promise;
+    if (existing) {
+      // Scope note: a broker callId dedupes CONCURRENT duplicates only. The
+      // memory client mints a fresh id per dispatch and cancels instead of
+      // replaying (runtime/memory/lib/agent-ipc.mjs callAgentDispatch), so a
+      // settled id carries no promise and needs no retained result.
+      // Within that window a callId is still an idempotency key, not an
+      // overwrite slot: answering a different payload from an unrelated
+      // in-flight run is silent data loss.
+      if (signature && existing.signature && existing.signature !== signature) {
+        return Promise.reject(Object.assign(
+          new Error(`agent dispatch callId '${id}' was reused with a different payload`),
+          { code: 'ECALLIDCONFLICT' },
+        ));
+      }
+      return existing.promise;
+    }
 
     const controller = new AbortController();
     const abortFromCaller = () => {
@@ -146,7 +177,7 @@ export function createAgentDispatchBroker({
       if (inFlight.get(id) === record) inFlight.delete(id);
       try { onActivityChanged?.(snapshot()); } catch {}
     });
-    record = { controller, promise: tracked };
+    record = { controller, promise: tracked, signature };
     inFlight.set(id, record);
     try { onActivityChanged?.(snapshot()); } catch {}
     return tracked;

package/src/standalone/agent-tool/job-task-reconcile.mjs

@@ -0,0 +1,78 @@
+// Background-task reconcile for a worker turn (spawn AND send paths).
+//
+// A worker turn has to mark its background task terminal from three separate
+// windows, and both paths must do it identically — they used to carry two
+// byte-identical copies of every block:
+//
+//   1. TERMINAL RESULT — the worker produced its final result. Reconciling
+//      here (rather than after the session save) keeps a hung/slow post-result
+//      step from stranding the task, and the status card, in `running`. An
+//      empty/abnormal finish is a FAILURE, not a completion, so the Lead card
+//      renders `error: …` instead of a header-only empty card.
+//   2. STREAM STALLED — a mid-stream stall (StreamStalledError / ESTREAMSTALL)
+//      throws WITHOUT a terminal result, so the finally net below (gated on
+//      _terminalResultValue) is skipped and only the outer task-reject path
+//      would notify. Reconciling to `failed` here guarantees the owner (Lead)
+//      gets a failure notification instead of a task stuck in `running`.
+//   3. FINALLY — safety net for a post-result step (session save) that hung or
+//      threw after a terminal result already existed.
+//
+// Every call is idempotent (the first terminal state wins, so the outer reject
+// path cannot double-notify) and absorbs its own errors, so reporting on a
+// turn can never break the turn.
+import { reconcileBackgroundTask } from '../../runtime/shared/background-tasks.mjs';
+
+export function reconcileJobTerminalResult(job, value) {
+  if (!job?.taskId) return;
+  try {
+    reconcileBackgroundTask(job.taskId, value.error
+      ? {
+          status: 'failed',
+          result: value,
+          error: value.error,
+          terminalReason: 'agent-empty-final',
+        }
+      : {
+          status: 'completed',
+          result: value,
+          terminalReason: 'agent-terminal-result',
+        });
+  } catch {}
+}
+
+/** Watchdog stall that still recovered a partial handoff: a completion. */
+export function reconcileJobWatchdogPartial(job, value) {
+  if (!job?.taskId) return;
+  try {
+    reconcileBackgroundTask(job.taskId, {
+      status: 'completed',
+      result: value,
+      terminalReason: 'agent-watchdog-partial',
+    });
+  } catch {}
+}
+
+export function reconcileJobStreamStalled(job, error) {
+  if (!job?.taskId || job._terminalResultValue !== undefined) return;
+  try {
+    reconcileBackgroundTask(job.taskId, {
+      status: 'failed',
+      error,
+      terminalReason: 'agent-stream-stalled',
+    });
+  } catch {}
+}
+
+export function reconcileJobFinally(job, finalStatus) {
+  if (!job || job._terminalResultValue === undefined) return;
+  try {
+    reconcileBackgroundTask(job.taskId, {
+      status: finalStatus === 'error' ? 'failed' : 'completed',
+      result: job._terminalResultValue,
+      ...(finalStatus === 'error' && job._terminalResultValue?.error
+        ? { error: job._terminalResultValue.error }
+        : {}),
+      terminalReason: 'agent-finally-reconcile',
+    });
+  } catch {}
+}

package/src/standalone/agent-tool/notify.mjs

@@ -28,7 +28,9 @@ export function createNotify(mgr, { notifySessionCompletion } = {}) {
       }
       // Mark this as a deferred completion/task notification so a later session
       // resume drops it rather than replaying it out-of-order (owner decision).
-      return Boolean(mgr.enqueuePendingMessage(target, markCompletionEntry(visible)) > 0);
+      return Boolean(mgr.enqueuePendingMessage(target, markCompletionEntry(visible, {
+        executionId: meta?.execution_id,
+      })) > 0);
     } catch {
       return false;
     }

package/src/standalone/agent-tool/spawn-flow.mjs

@@ -4,7 +4,13 @@
 // execution with turn-review collection and terminal accounting.
 import { agentDefinitionExists, clean, clearAgentStatuslineRoute, nonNegativeInt, normalizeAgentName, positiveInt, presetKey, readAgentFrontmatterPermission, resolvePrompt, terminalPidForContext, writeAgentStatuslineRoute } from './helpers.mjs';
 import { createNotify } from './notify.mjs';
-import { reconcileBackgroundTask, sanitizeTaskMeta, startBackgroundTask } from '../../runtime/shared/background-tasks.mjs';
+import { sanitizeTaskMeta, startBackgroundTask } from '../../runtime/shared/background-tasks.mjs';
+import {
+  reconcileJobFinally,
+  reconcileJobStreamStalled,
+  reconcileJobTerminalResult,
+  reconcileJobWatchdogPartial,
+} from './job-task-reconcile.mjs';
 import { isAgentDisabled } from '../../runtime/shared/agent-route-config.mjs';
 import { abnormalEmptyFinishError, renderResult } from './render.mjs';
 import { resourceAdmission } from '../../runtime/shared/resource-admission.mjs';
@@ -14,8 +20,14 @@ import { normalizeAgentPermission } from '../../runtime/shared/markdown-frontmat
 import { resolveAgentSpawnPreset } from './spawn-preset.mjs';
 import { resolveAgentWatchdogPolicy, resolveHandoffMessageStartIndex, watchdogPartialHandoffFromError } from '../../runtime/agent/orchestrator/agent-runtime/agent-progress-watchdog.mjs';
 import { prepareAgentSession } from '../../runtime/agent/orchestrator/agent-runtime/session-builder.mjs';
+import { saveSessionAsync } from '../../runtime/agent/orchestrator/session/store.mjs';
 import { AGENT_OWNER } from '../../runtime/agent/orchestrator/agent-owner.mjs';
 import { getProvider } from '../../runtime/agent/orchestrator/providers/registry.mjs';
+// Mid-turn worker persistence cadence. The watchdog sweep runs every second;
+// a transcript save is far more expensive than a bookkeeping stamp, so the
+// in-progress snapshot lands on this slower clock.
+const AGENT_PROGRESS_SAVE_MS = 2_000;
+
 export function createSpawnFlow({
   mgr,
   forgetTerminalSession,
@@ -189,6 +201,35 @@ export function createSpawnFlow({
     });
   };
 
+  // In-turn progress stamp. turnStartStamper only fires at a TURN boundary, so
+  // one long first turn (a review agent easily runs 20+ tool iterations) left
+  // the worker row untouched for minutes and the panel looked stalled. The
+  // watchdog sweep reports each observed change; the row keeps its own live
+  // message count and updatedAt from it.
+  const progressStamper = (session, tag) => {
+    let lastSavedAt = 0;
+    return (progress = {}) => {
+      const messages = Number(progress?.messages) || 0;
+      upsertWorkerSessionDeferred(session, tag, {
+        status: 'running',
+        stage: 'running',
+        ...(messages > 0 ? { messages } : {}),
+      });
+      // Mid-turn durability. A worker transcript otherwise reaches disk only
+      // when the turn ENDS, so a pane opened on a running worker shows the
+      // prompt and nothing after it — the work is real but invisible to every
+      // viewer. Persisting on the sweep makes the in-progress transcript
+      // readable like any other session. Throttled: a transcript save is not
+      // free, and the sweep runs every second.
+      const now = Date.now();
+      if (now - lastSavedAt < AGENT_PROGRESS_SAVE_MS) return;
+      lastSavedAt = now;
+      try {
+        Promise.resolve(saveSessionAsync(session)).catch(() => {});
+      } catch { /* progress persistence is best-effort */ }
+    };
+  };
+
   async function prepareSpawn(args, callerCwd = null, context = {}, prepState = null) {
     refreshTagsFromSessions({ context });
     return prepareSpawnInProcess(args, callerCwd, context, prepState);
@@ -325,6 +366,7 @@ export function createSpawnFlow({
     const { args, tag, session, agent, preset, presetName, workerCwd, prompt, watchdogPolicy } = prepared;
     const watchdog = startProgressIdleWatchdog(session.id, watchdogPolicy, agent, {
       onTurnStart: turnStartStamper(session, tag),
+      onProgress: progressStamper(session, tag),
     });
     const turnReview = createTurnReviewCollector(session, tag, agent, notifyContext || {});
     let finalStatus = 'idle';
@@ -374,29 +416,7 @@ export function createSpawnFlow({
             const value = completionValue(terminalResult);
             if (job) job._terminalResultValue = value;
             notifyOwnerAgentCompletionEarly(job, value, notifyContext || {});
-            // Mark the task terminal the moment the worker produces its final
-            // result, so a hung/slow post-result session save cannot strand the
-            // task (and the status card) in `running`. Idempotent; the finally
-            // reconcile remains a backup for the error/no-terminal-result path.
-            if (job?.taskId) {
-              try {
-                // An empty/abnormal finish is a failure, not a completion:
-                // reconcile as `failed` with the accurate error so the Lead
-                // card renders `error: …` instead of a header-only empty card.
-                reconcileBackgroundTask(job.taskId, value.error
-                  ? {
-                      status: 'failed',
-                      result: value,
-                      error: value.error,
-                      terminalReason: 'agent-empty-final',
-                    }
-                  : {
-                      status: 'completed',
-                      result: value,
-                      terminalReason: 'agent-terminal-result',
-                    });
-              } catch {}
-            }
+            reconcileJobTerminalResult(job, value);
           },
         } : {}),
       });
@@ -431,34 +451,11 @@ export function createSpawnFlow({
           stallAbort: true,
         };
         if (job) job._terminalResultValue = value;
-        if (job?.taskId) {
-          try {
-            reconcileBackgroundTask(job.taskId, {
-              status: 'completed',
-              result: value,
-              terminalReason: 'agent-watchdog-partial',
-            });
-          } catch {}
-        }
+        reconcileJobWatchdogPartial(job, value);
         return value;
       }
       finalStatus = 'error';
-      // Part C: a mid-stream stall (StreamStalledError / ESTREAMSTALL) throws
-      // here WITHOUT a terminal result, so the finally reconcile below (gated on
-      // _terminalResultValue) would be skipped and only the outer task-reject
-      // path would notify. Belt-and-suspenders: reconcile this job to `failed`
-      // now so the owner (Lead) always gets a failure notification instead of a
-      // task stranded in `running`. Idempotent — completeBackgroundTask no-ops
-      // once terminal, so the outer reject path can't double-notify.
-      if (job?.taskId && job._terminalResultValue === undefined) {
-        try {
-          reconcileBackgroundTask(job.taskId, {
-            status: 'failed',
-            error,
-            terminalReason: 'agent-stream-stalled',
-          });
-        } catch {}
-      }
+      reconcileJobStreamStalled(job, error);
       throw error;
     } finally {
       turnReview.complete();
@@ -475,23 +472,7 @@ export function createSpawnFlow({
         finishedAt: new Date().toISOString(),
       });
       setImmediate(notifyStatusChange);
-      // Safety net: if a post-result step (session save) hung or threw after the
-      // worker already produced a terminal result, the task could otherwise be
-      // stranded in `running`. Reconcile it to a terminal state using the
-      // captured result so the owner gets a completion notification + the
-      // statusline clears. Idempotent once the task is already terminal.
-      if (job && job._terminalResultValue !== undefined) {
-        try {
-          reconcileBackgroundTask(job.taskId, {
-            status: finalStatus === 'error' ? 'failed' : 'completed',
-            result: job._terminalResultValue,
-            ...(finalStatus === 'error' && job._terminalResultValue?.error
-              ? { error: job._terminalResultValue.error }
-              : {}),
-            terminalReason: 'agent-finally-reconcile',
-          });
-        } catch {}
-      }
+      reconcileJobFinally(job, finalStatus);
       scheduleReap(session.id);
       // SubagentStop: worker finished (terminal), regardless of outcome.
       emitSubagentEvent('stop', agent, { session_id: session.id, tag, status: finalStatus });
@@ -510,6 +491,7 @@ export function createSpawnFlow({
     progressWatchdogs,
     startProgressIdleWatchdog,
     turnStartStamper,
+    progressStamper,
     prepareSpawn,
     prepareSpawnInProcess,
     runSpawn,