@@ -4615,6 +4615,11 @@ components:
           type: boolean
           title: Turn In Flight
           default: false
+        stalled_turn:
+          description: The session's turn, when it is stalled (no task activity past its allowance); null otherwise.
+          anyOf:
+            - $ref: '#/components/schemas/TurnStall'
+            - type: 'null'
         restartable:
           type: boolean
           title: Restartable
@@ -10054,6 +10059,44 @@ components:
         - looks
         - native_deleted
       additionalProperties: false
+    TurnStall:
+      description: >-
+        A delivered turn whose task has shown no activity for longer than its allowance. It may still
+        finish; the next task event clears it. Nothing is replayed: stop or restart the session to
+        recover.
+      type: object
+      properties:
+        message_id:
+          description: The delivery (the user message) whose turn is stalled.
+          type: string
+        session_id:
+          type: string
+        task_id:
+          anyOf:
+            - type: string
+            - type: 'null'
+        main_thread:
+          description: Whether the session is the owner's main thread.
+          type: boolean
+        last_activity_at:
+          description: The last task event Mainloop saw, or when the turn was delivered if none.
+          type: string
+          format: date-time
+        stalled_at:
+          type: string
+          format: date-time
+        tool_running:
+          description: The last event started a tool call with no result yet, which has the longer allowance.
+          type: boolean
+      required:
+        - message_id
+        - session_id
+        - task_id
+        - main_thread
+        - last_activity_at
+        - stalled_at
+        - tool_running
+      additionalProperties: false
     HealthView:
       type: object
       properties:
@@ -10062,6 +10105,12 @@ components:
           items:
             $ref: '#/components/schemas/HealthRow'
           maxItems: 3000
+        stalled_turns:
+          description: Delivered turns marked stalled (no task activity past their allowance), oldest stall first. Always sent; absent only from older servers.
+          type: array
+          items:
+            $ref: '#/components/schemas/TurnStall'
+          maxItems: 200
         stops:
           description: Requested stops that stayed unconfirmed past the resolver's bound, oldest first.
           type: array
 
@@ -178,4 +178,5 @@ MSW fixtures typed from `api/openapi.yaml`.
   **Start a task in <first project>**, **What's running?**, **Pause a schedule**). Each fills the
   composer, unsent. They go once the thread has a message.
 - The native identity strip in the header details is supplied by the sessions slice.
+- A stalled turn (no task activity past its allowance, see [orchestration health](orchestration-health.md#stalled-turns)) shows the turn recovery panel instead of leaving only the spinner: "No activity for 25m. It may still finish. Stop or restart?" (with "while a tool runs" when the last event started a tool call), a **stop** button, and **restart session** when the thread is restartable. A stalled turn stays separate from a failed one: the next task event clears the panel, and nothing is resent. The owner also gets an attention item for it. Tested with MSW only.
 - A failed stop on the main thread shows the turn recovery panel below the conversation, with **restart session** behind an in-app confirmation that says the native context is lost (see [sessions](sessions.md#react-status)). The stop error now carries the server's reason. Tested with MSW only.
@@ -473,3 +473,52 @@ the section rather than hidden.
 Not built: a push notification for an unresolved stop. Not proven: the signal against a live
 runtime that refuses to die, only against the fake in `server/internal/tasks/stop_force_test.go`
 and the database-backed `TestViewListsUnresolvedStops`.
+
+## Stalled turns
+
+Status: **implemented**, 2026-10-18 (issue #265). Tested against the fake kagent and a scratch
+PostgreSQL with a test clock; **not measured** against a live kagent.
+
+On 2026-10-18 the main thread showed "Searching the web…" for over two hours, and four tasks were
+in the same state: each turn's task had gone silent inside kagent and nothing in Mainloop treated
+that as abnormal. A stalled turn is that signal for one delivered turn. It is separate from task
+liveness above (which blocks a `running` task) and from a failed delivery: a stalled turn may still
+finish.
+
+- **What is tracked.** For every `delivered` delivery, the delivery loop records when it last saw a
+  live event of the turn's task (`deliveries.activity_at`) and what that event left the turn doing
+  (`activity_kind`): `event` (thinking or writing), `tool` (a tool call started with no result yet)
+  or `parked` (waiting for the owner's input or auth). Live events are the send stream and every
+  event of a subscription after its first. The first event of a subscription is the task as it
+  stands, so a resubscribe to a silent task does not reset the clock; it counts only when its status
+  was recorded after the activity already stored. Writes are throttled (at most one activity time
+  per 30 seconds per turn; a change of kind or the end of a stall is written at once), fenced on the
+  delivery's claim, and never touch `updated_at`, `state` or `outcome_version`.
+- **When a turn is stalled.** A `mark-stalled-turns` sweep (every 30 seconds) sets `stalled_at` on a
+  delivered turn whose last activity (or, before any, the time it was marked delivered) is older
+  than its allowance: `SESSION_STALL_SECONDS` (1500, 25 minutes), or `SESSION_STALL_TOOL_SECONDS`
+  (3600, an hour; never less than the first) while a tool call is running, since a web search or a
+  long build emits nothing until it ends. A parked turn is never stalled. The sweep publishes
+  `session:message` for the turn's session so an open page re-reads it, and logs a warning.
+- **Clearing.** The next live event clears `stalled_at` in the same write that records it and
+  publishes `session:message` again. A turn that ends is no longer counted, whatever its
+  `stalled_at`.
+- **Where it shows.** `NativeSessionInfo.stalled_turn` (`GET /main-thread` and
+  `GET /sessions/{id}/native`) carries the turn, its last activity, when it was marked and whether a
+  tool was running; `null` otherwise. `HealthView.stalled_turns` lists every stalled turn of the
+  owner, oldest stall first (at most 200). The `task`, `session` and `attempt` filters narrow it;
+  the time window does not. The Health page shows a "Stalled turns" section above the rows when the
+  list is not empty, and counts an entry it cannot read rather than hiding it.
+- **Attention.** The attention sweep opens one `owner_decision` item per stalled turn of the main
+  thread or a standalone session (`source_kind = turn_stalled`, `reason_code = stalled`, linking to
+  the main thread or the session) and resolves it once the turn moves again or ends. A task-owned
+  session is left to the task liveness sweep, which already blocks the task as `stalled` and opens
+  its own card.
+- **Never a replay.** The watch only surfaces the stall. It changes no delivery state, sends
+  nothing and retries nothing. Recovery is the owner's stop, or the restart of
+  [sessions](sessions.md#go-server-status-g6a-g6b), which deletes the native session and fails the turn.
+
+Not proven: behavior against a live kagent. The fake-clock tests in
+`server/internal/sessions/stall_test.go` cover a turn stalled past its allowance and cleared by
+the next event, no stall while a tool runs within its longer allowance, and no stall for a parked
+turn.
@@ -31,6 +31,7 @@ History before `e776537` describes the retired Python backend. Where other text
   task attempt.
 - Stop turn cancels the A2A task with `CancelTask` (the kagent client and `kagenttest` both have it). It takes no lock (cancel is the one that takes the per-session send lock); the one-open-turn index and the fenced writes keep it consistent with a send. A delivery still `recorded` is cancelled without any kagent call. The task is cancelled outside any transaction; the delivery ends `cancelled`, the queue is held, and the partial reply and the stop note go into one message in one transaction (the note's id is derived from the delivery, so the delivery loop and the stop call settle the same turn once). Results: `stopped`, `finished` (the task had already ended, and its real outcome is recorded), `no_open_turn`. A task that is not visible yet or still running after the cancel is `409` and nothing changes; a kagent error is `502`. An `uncertain` delivery counts as open while it is inside its hold; one past the hold is skipped, since it no longer blocks sends and the delivery loop fails it, so it cannot mask a newer running turn. The stop is not repeated blindly.
 - Restart (`POST /sessions/{id}/restart`, issue #262) is the way out of a turn that stop cannot confirm, such as a runtime wedged inside kagent that never answers `CancelTask` (kagent will not suspend a Session with a non-terminal task either). The body carries a caller-chosen `request_id`, the idempotency key. Under the session's send lock Mainloop first writes the intent (`session_restarts`, state `requested`, naming the kagent Session to delete), then, with no transaction open, reads the Session and deletes it only if kagent still shows it, and reads it again when the delete reply still shows it running. kagent answering NotFound, `DELETED` or `DELETING` (a delete it has accepted, which cannot be undone and admits nothing) counts as gone. One transaction under the send lock then makes the binding forget that Session (fenced on its id, so a newer Session is never touched; a new create request id, and the standing context cleared), settles every `sending`, `delivered` or `uncertain` delivery sent to it as `failed` with "the native session was restarted before this turn finished; it was not sent again", admits the oldest `queued` message, and marks the intent `done` with the failed ids. Failed, not uncertain: Mainloop knows the Session is gone, so the message cannot still run, and nothing waits out `SESSION_UNCERTAIN_HOLD_SECONDS`. A `recorded` message has not been sent and is left for the new Session. The next message creates a new kagent Session that carries the recent conversation (the replacement path above); the native context is lost. The response is `restarted` (or `no_native_session` when the binding had none) with `failed_message_ids`. Repeating the same `request_id` returns the recorded outcome and deletes nothing; a different id while a restart is open continues the open one. A delete kagent does not confirm is `502` and keeps the intent `requested`; a repeat, or the `resume-session-restarts` sweep (every 30 seconds, for intents idle a minute), continues it the same way. Only the main thread and standalone native sessions can be restarted: a workspace session (its runtime belongs to the workspace service), a task-owned session (the task's stop path force-deletes a runtime that never answers, see [orchestration health](orchestration-health.md#unconfirmed-stops)), an archived, cancelled or failed session, and a main thread whose provider switch is pending are `409`. `NativeSessionInfo.restartable` says whether it applies. Nothing is restarted automatically and no prompt is replayed. Tested against the fake kagent only; not measured against a live kagent.
+- A delivered turn whose task shows no activity past its allowance is marked stalled; it is shown with stop and restart and raised as attention, and the next event clears it. It is an observation, not a delivery state: see [orchestration health](orchestration-health.md#stalled-turns).
 - A delivered or uncertain turn whose task kagent no longer has (`GetTask` not found, or no task shows the message) is checked against its kagent Session: when kagent shows the Session gone (NotFound, deleting or deleted), the turn fails at once with "the kagent session no longer exists, so this turn cannot finish; it was not sent again" instead of waiting out the uncertain hold, and the queue moves on. A task that is missing while its Session still exists keeps the uncertain path.
 - Cancel closes the session's open deliveries except task-owned `sending` and `uncertain` rows,
   whose claims and unresolved outcomes are retained for reconciliation without replay. In the same
@@ -213,7 +214,7 @@ Labels: **implemented** means built in `web/` and covered by component or route
 
 - **Implemented:** session rows (on the project page); the `/agents` form, reachable by URL only (Claude Code or Codex, Ctrl/Cmd+Enter submits, blocked while offline); and the session page. The page offers **Stop turn** only while the native state reports a turn in flight, and never on archived, failed or cancelled sessions, **Cancel session** through an in-app confirmation (never `window.confirm`), and **Clear** for completed, failed and cancelled sessions, which returns to the main chat. It also shows the task link, workspace badges, summary or error, the identity strip, and the not-found, server error and unreachable states.
 - **Implemented:** after any session action, the page re-reads the session, its native state and attention before it shows the result. A `409` therefore shows the current state.
-- **Implemented:** the turn recovery panel in every chat (main thread and session chat). While a turn is in flight, the session is `restartable` and the last stop failed, it says the turn could not be stopped and offers **restart session**. The in-app confirmation (never `window.confirm`) says the native context is lost, the open turn ends as failed and is not sent again, and the next message starts a new native session with the recent conversation. One request id is kept per restart until it succeeds, so a retry after a lost reply or a `502` continues the same restart. Tested with MSW only.
+- **Implemented:** the turn recovery panel in every chat (main thread and session chat). While a turn is in flight it shows for a stalled turn (how long it has been quiet, with **stop**, and **restart session** when the session is `restartable`), and for a restartable session whose last stop failed (it says the turn could not be stopped and offers **restart session**). The in-app confirmation (never `window.confirm`) says the native context is lost, the open turn ends as failed and is not sent again, and the next message starts a new native session with the recent conversation. One request id is kept per restart until it succeeds, so a retry after a lost reply or a `502` continues the same restart. Tested with MSW only.
 - **Implemented:** while the session page first loads, placeholder rows with a row's height sit under the loading text. The text is what a screen reader announces; the placeholders are hidden from it.
 - **Wording:** the identity strip's live word is the agent's own state, shown verbatim. It shows `live` when the agent is ready, otherwise whatever state string the agent reports (for example `busy` or `suspended`, and any other word it sends), or `unknown` when there is no state yet. A failed or unconfirmed last delivery takes priority and shows as `last message failed` or `last message unconfirmed`, so it never reads `live`. A cancelled session shows `cancelled` the same way, even when the agent still reports ready. When the backend cannot be reached the word is `unreachable`, which the page adds itself; an agent never reports it.
 - **Implemented:** the session chat in the page's chat slot (`SessionChatSlot`). It shows the session's own conversation, with the same timeline, delivery notices, retry and composer as the main thread. It reads `GET /sessions/{id}/native` and `GET /sessions/{id}/conversation`, and sends to `POST /sessions/{id}/message`. Its unsent draft is kept for that session only. While a turn is in flight the header shows the turn's state and a **stop** button. A cancelled session's header reads `cancelled`, never the agent's own `ready`, and the **stop** button is hidden when the native state is unknown or malformed. Its pending requests show as cards at the end of the conversation (below); it does not show the topic index.
 
@@ -231,6 +231,7 @@ func serveAPI(ctx context.Context, cfg *config.Config, log *slog.Logger) error {
 	runner.AddSweep(svc.CancelSweep())
 	runner.AddSweep(svc.PromoteStrandedQueuedSweep())
 	runner.AddSweep(svc.RestartSweep())
+	runner.AddSweep(svc.StallSweep())
 	runner.Add(hitlSvc.ResponseLoop())
 	runner.AddSweep(hitlSvc.ObserverSweep())
 	runner.AddSweep(attn.Sweep())