From 14a6c21fbe359201cab2a5cfb698ec9a93bfe839 Mon Sep 17 00:00:00 2001
From: dimakis <dimitri.saridakis@gmail.com>
Date: Sat, 4 Jul 2026 15:20:59 +0100
Subject: [PATCH] fix(orchestrator): prevent runaway session spawning with
 multi-layer safety
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Root cause: ID namespace mismatch in orphan detection — getActiveSessionIds()
returned SDK sessionIds (UUIDs) but tasks stored clientIds (headless:xxx),
causing every spawned task to look orphaned and triggering infinite respawns.

Safety layers:
- Fix ID namespace to use clientIds consistently
- Grace period (60s) before orphan detection can reclaim recently-spawned tasks
- Spawn depth limit (5 per tick chain) prevents runaway in single tick
- Global rate limiter (5 per 60s window) caps cross-chain spawning
- Kill switch (spawnEnabled flag, default OFF) with UI toggle
- Clear spawn tracking state on start()/stop() to prevent cross-goal leakage

Client propagation:
- spawnEnabled added to LoopStatus type, protocol parser, store, and API client
- Optimistic UI update for instant toggle feedback
- CSS classes in global scope for mobile visibility

Tests: 82 passing (orchestrator + route endpoint tests)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 frontend/src/components/TaskBoardSection.tsx  |  18 +-
 frontend/src/components/TokenBar.tsx          |   8 -
 .../components/__tests__/TokenBar.test.tsx    |  11 -
 .../src/hooks/__tests__/useTaskBoard.test.ts  |   1 +
 frontend/src/hooks/useTaskBoard.ts            |   3 +
 .../pages/__tests__/DesktopChatView.test.tsx  |   3 +-
 .../src/pages/__tests__/TaskBoard.test.tsx    |   1 +
 frontend/src/styles/global.css                |  46 +-
 frontend/src/types/task.ts                    |   1 +
 frontend/src/types/ws-messages.ts             |   7 +-
 .../client/__tests__/protocol-parser.test.ts  |  21 +-
 packages/client/src/api-client.ts             |  12 +
 packages/client/src/protocol-parser.ts        |   5 +-
 packages/client/src/slices/tasks.ts           |   2 +
 packages/client/src/slices/tokens.ts          |   2 -
 packages/client/src/store.ts                  |  13 +
 packages/harness/src/session-registry.ts      |   4 -
 server/__tests__/session-overview.test.ts     |   1 +
 server/__tests__/task-orchestrator.test.ts    | 574 ++++++++++++++----
 server/__tests__/task-routes.test.ts          |  68 ++-
 server/__tests__/token-update.test.ts         |  71 ---
 server/app.ts                                 |  15 +
 server/chat.ts                                |   5 -
 server/index.ts                               |  58 +-
 server/query-loop.ts                          |  22 -
 server/task-orchestrator.ts                   | 114 +++-
 26 files changed, 713 insertions(+), 373 deletions(-)

diff --git a/frontend/src/components/TaskBoardSection.tsx b/frontend/src/components/TaskBoardSection.tsx
index 376aecdb..bcbbf7f5 100644
--- a/frontend/src/components/TaskBoardSection.tsx
+++ b/frontend/src/components/TaskBoardSection.tsx
@@ -26,6 +26,7 @@ export function TaskBoardSection() {
     pauseLoop,
     resumeLoop,
     stopLoop,
+    setSpawnEnabled,
     approveTask,
     rejectTask,
     approveSpec,
@@ -47,7 +48,7 @@ export function TaskBoardSection() {
     [deleteTask],
   );
 
-  const { state, progress, awaitingApproval } = loopStatus;
+  const { state, progress, awaitingApproval, spawnEnabled } = loopStatus;
 
   // Count items needing attention
   const needsAttention = tasks.filter(
@@ -60,9 +61,18 @@ export function TaskBoardSection() {
       badge={needsAttention || undefined}
       storageKey="cc-taskboard"
       actions={
-        <button className="cc-section-action-btn" onClick={refresh} title="Refresh">
-          &#x21bb;
-        </button>
+        <>
+          <button
+            className={`cc-section-action-btn ${spawnEnabled ? 'cc-spawn-enabled' : 'cc-spawn-disabled'}`}
+            onClick={() => setSpawnEnabled(!spawnEnabled)}
+            title={spawnEnabled ? 'Disable session spawning' : 'Enable session spawning'}
+          >
+            {spawnEnabled ? '\u26A1' : '\u26D4'}
+          </button>
+          <button className="cc-section-action-btn" onClick={refresh} title="Refresh">
+            &#x21bb;
+          </button>
+        </>
       }
     >
       {/* Compact loop bar */}
diff --git a/frontend/src/components/TokenBar.tsx b/frontend/src/components/TokenBar.tsx
index b3b6068c..b18353fa 100644
--- a/frontend/src/components/TokenBar.tsx
+++ b/frontend/src/components/TokenBar.tsx
@@ -29,14 +29,6 @@ export function TokenBar({ tokenState }: Props) {
   // Show only session total in that case — the agent context bar is meaningless.
   const isCompleted = agentContext === 0 && sessionTotal > 0;
 
-  if (tokenState.compacting) {
-    return (
-      <div className="token-bar token-bar--compacting" aria-label="Compacting context">
-        <span className="token-bar-compacting-label">COMPACTING</span>
-      </div>
-    );
-  }
-
   return (
     <>
       <button
diff --git a/frontend/src/components/__tests__/TokenBar.test.tsx b/frontend/src/components/__tests__/TokenBar.test.tsx
index d37f4585..6e688ff1 100644
--- a/frontend/src/components/__tests__/TokenBar.test.tsx
+++ b/frontend/src/components/__tests__/TokenBar.test.tsx
@@ -12,7 +12,6 @@ function makeState(overrides: Partial<TokenState> = {}): TokenState {
     numTurns: 0,
     turnIndex: 0,
     numCompactions: 0,
-    compacting: false,
     ...overrides,
   };
 }
@@ -105,16 +104,6 @@ describe('TokenBar', () => {
     expect(screen.getByText(/Session tokens/)).toBeTruthy();
   });
 
-  it('shows compacting indicator when compacting is true', () => {
-    const { container } = render(
-      <TokenBar tokenState={makeState({ agentContext: 170000, turnIndex: 3, compacting: true })} />,
-    );
-    expect(container.querySelector('.token-bar--compacting')).toBeTruthy();
-    expect(screen.getByText(/COMPACTING/)).toBeTruthy();
-    // Normal token display should not be visible
-    expect(screen.queryByText(/170k/)).toBeNull();
-  });
-
   it('expands detail panel on tap', () => {
     render(
       <TokenBar
diff --git a/frontend/src/hooks/__tests__/useTaskBoard.test.ts b/frontend/src/hooks/__tests__/useTaskBoard.test.ts
index 886d1507..6e977a95 100644
--- a/frontend/src/hooks/__tests__/useTaskBoard.test.ts
+++ b/frontend/src/hooks/__tests__/useTaskBoard.test.ts
@@ -98,6 +98,7 @@ describe('useTaskBoard', () => {
       progress: null,
       specMode: false,
       awaitingApproval: false,
+      spawnEnabled: false,
     });
 
     const { result } = renderHook(() => useTaskBoard(), { wrapper });
diff --git a/frontend/src/hooks/useTaskBoard.ts b/frontend/src/hooks/useTaskBoard.ts
index 2806071a..1763ce4f 100644
--- a/frontend/src/hooks/useTaskBoard.ts
+++ b/frontend/src/hooks/useTaskBoard.ts
@@ -145,6 +145,7 @@ export interface UseTaskBoardResult {
   pauseLoop: () => Promise<void>;
   resumeLoop: () => Promise<void>;
   stopLoop: () => Promise<void>;
+  setSpawnEnabled: (enabled: boolean) => Promise<void>;
   approveTask: (id: string) => Promise<void>;
   rejectTask: (id: string, feedback: string) => Promise<void>;
   approveSpec: () => Promise<void>;
@@ -170,6 +171,7 @@ export function useTaskBoard(): UseTaskBoardResult {
   const storePauseLoop = useMitzoStore((s) => s.pauseLoop);
   const storeResumeLoop = useMitzoStore((s) => s.resumeLoop);
   const storeStopLoop = useMitzoStore((s) => s.stopLoop);
+  const storeSetSpawnEnabled = useMitzoStore((s) => s.setSpawnEnabled);
   const storeApproveTask = useMitzoStore((s) => s.approveTask);
   const storeRejectTask = useMitzoStore((s) => s.rejectTask);
   const storeApproveSpec = useMitzoStore((s) => s.approveSpec);
@@ -237,6 +239,7 @@ export function useTaskBoard(): UseTaskBoardResult {
     pauseLoop: storePauseLoop,
     resumeLoop: storeResumeLoop,
     stopLoop: storeStopLoop,
+    setSpawnEnabled: storeSetSpawnEnabled,
     approveTask: storeApproveTask,
     rejectTask: storeRejectTask,
     approveSpec: storeApproveSpec,
diff --git a/frontend/src/pages/__tests__/DesktopChatView.test.tsx b/frontend/src/pages/__tests__/DesktopChatView.test.tsx
index e12cf5de..d8dd7631 100644
--- a/frontend/src/pages/__tests__/DesktopChatView.test.tsx
+++ b/frontend/src/pages/__tests__/DesktopChatView.test.tsx
@@ -98,6 +98,7 @@ function createMockStore() {
         progress: null,
         specMode: false,
         awaitingApproval: false,
+        spawnEnabled: false,
       },
     },
     workload: { items: [], profiles: [] },
@@ -112,7 +113,6 @@ function createMockStore() {
       numTurns: 0,
       turnIndex: 0,
       numCompactions: 0,
-      compacting: false,
     },
     progress: { blocks: {}, toolIndex: {} },
     sendError: null,
@@ -137,6 +137,7 @@ function createMockStore() {
     pauseLoop: vi.fn().mockResolvedValue(undefined),
     resumeLoop: vi.fn().mockResolvedValue(undefined),
     stopLoop: vi.fn().mockResolvedValue(undefined),
+    setSpawnEnabled: vi.fn().mockResolvedValue(undefined),
     approveTask: vi.fn().mockResolvedValue(undefined),
     rejectTask: vi.fn().mockResolvedValue(undefined),
     approveSpec: vi.fn().mockResolvedValue(undefined),
diff --git a/frontend/src/pages/__tests__/TaskBoard.test.tsx b/frontend/src/pages/__tests__/TaskBoard.test.tsx
index 2ab455bc..ee89690f 100644
--- a/frontend/src/pages/__tests__/TaskBoard.test.tsx
+++ b/frontend/src/pages/__tests__/TaskBoard.test.tsx
@@ -72,6 +72,7 @@ vi.mock('../../hooks/useTaskBoard', () => ({
       progress: null,
       specMode: false,
       awaitingApproval: false,
+      spawnEnabled: false,
     },
     createTask: mockCreateTask,
     updateTask: mockUpdateTask,
diff --git a/frontend/src/styles/global.css b/frontend/src/styles/global.css
index ba264385..2dfa0444 100644
--- a/frontend/src/styles/global.css
+++ b/frontend/src/styles/global.css
@@ -77,6 +77,14 @@ a {
   text-decoration: none;
 }
 
+.cc-spawn-enabled {
+  color: var(--task-active);
+}
+
+.cc-spawn-disabled {
+  color: var(--danger);
+}
+
 a:hover {
   text-decoration: underline;
 }
@@ -1475,9 +1483,6 @@ textarea:focus {
   background: var(--surface);
   border-bottom: 1px solid var(--border);
   flex-shrink: 0;
-  position: relative;
-  z-index: 20;
-  box-shadow: 0 4px 0 0 var(--surface);
   transition:
     max-height 0.2s,
     padding 0.2s,
@@ -1669,7 +1674,7 @@ textarea:focus {
   flex: 1;
   overflow-y: auto;
   -webkit-overflow-scrolling: touch;
-  padding: 0 var(--space-3) var(--space-4);
+  padding: var(--space-4) var(--space-3);
   display: flex;
   flex-direction: column;
   gap: var(--space-3);
@@ -2430,10 +2435,8 @@ textarea:focus {
   position: sticky;
   top: 0;
   z-index: 10;
-  margin: -1px calc(-1 * var(--space-3)) 0;
-  padding: 0 var(--space-3);
   border-bottom: 1px solid var(--border);
-  background: var(--surface);
+  background: var(--bg-primary);
 }
 
 .session-banner-header {
@@ -3467,35 +3470,6 @@ textarea:focus {
   animation: token-flash 0.8s ease-in-out infinite alternate;
 }
 
-.token-bar--compacting {
-  color: #fbbf24;
-  border-color: rgba(251, 191, 36, 0.6);
-  background: rgba(251, 191, 36, 0.15);
-  animation: compaction-pulse 1s ease-in-out infinite alternate;
-  cursor: default;
-  pointer-events: none;
-}
-
-.token-bar-compacting-label {
-  font-weight: 700;
-  font-size: var(--text-xxs);
-  letter-spacing: 0.12em;
-  text-transform: uppercase;
-}
-
-@keyframes compaction-pulse {
-  from {
-    opacity: 1;
-    border-color: rgba(251, 191, 36, 0.6);
-    box-shadow: 0 0 6px rgba(251, 191, 36, 0.3);
-  }
-  to {
-    opacity: 0.5;
-    border-color: rgba(251, 191, 36, 0.3);
-    box-shadow: 0 0 2px rgba(251, 191, 36, 0.1);
-  }
-}
-
 @keyframes token-flash {
   from {
     opacity: 1;
diff --git a/frontend/src/types/task.ts b/frontend/src/types/task.ts
index ab43d880..d151b247 100644
--- a/frontend/src/types/task.ts
+++ b/frontend/src/types/task.ts
@@ -18,6 +18,7 @@ export interface LoopStatus {
   progress: { done: number; total: number } | null;
   specMode: boolean;
   awaitingApproval: boolean;
+  spawnEnabled: boolean;
 }
 
 export interface Task {
diff --git a/frontend/src/types/ws-messages.ts b/frontend/src/types/ws-messages.ts
index ca4ef287..fc0b9bb9 100644
--- a/frontend/src/types/ws-messages.ts
+++ b/frontend/src/types/ws-messages.ts
@@ -250,7 +250,6 @@ export type ServerMessage =
   | TaskUpdatedMsg
   | TaskDeletedMsg
   | TokenUpdateMsg
-  | CompactionStatusMsg
   | LoopStatusMsg
   | ProgressStartMsg
   | ProgressUpdateMsg
@@ -302,11 +301,6 @@ export interface TokenUpdateMsg {
   turnIndex: number;
 }
 
-export interface CompactionStatusMsg {
-  type: 'compaction_status';
-  active: boolean;
-}
-
 export interface LoopStatusMsg {
   type: 'loop_status';
   state: 'idle' | 'running' | 'paused';
@@ -315,6 +309,7 @@ export interface LoopStatusMsg {
   progress: { done: number; total: number } | null;
   specMode: boolean;
   awaitingApproval: boolean;
+  spawnEnabled: boolean;
 }
 
 // Subagent lifecycle events
diff --git a/packages/client/__tests__/protocol-parser.test.ts b/packages/client/__tests__/protocol-parser.test.ts
index b6e5dd1d..fd37a630 100644
--- a/packages/client/__tests__/protocol-parser.test.ts
+++ b/packages/client/__tests__/protocol-parser.test.ts
@@ -473,6 +473,7 @@ describe('task system messages', () => {
         progress: { done: 2, total: 5 },
         specMode: false,
         awaitingApproval: false,
+        spawnEnabled: false,
       },
       makeState(),
       makeCallbacks(),
@@ -480,7 +481,7 @@ describe('task system messages', () => {
     );
     expect(r.tasksUpdate).toMatchObject({
       type: 'loop_status',
-      status: { state: 'running', goalId: 'g1' },
+      status: { state: 'running', goalId: 'g1', spawnEnabled: false },
     });
   });
 });
@@ -533,24 +534,6 @@ describe('token_update', () => {
     expect('sessionTotal' in r.tokensUpdate!).toBe(false);
     expect('numTurns' in r.tokensUpdate!).toBe(false);
   });
-
-  it('compaction_status sets compacting flag on tokensUpdate', () => {
-    const active = parseServerMessage(
-      { type: 'compaction_status', active: true },
-      makeState(),
-      makeCallbacks(),
-      POOL_KEY,
-    );
-    expect(active.tokensUpdate).toEqual({ compacting: true });
-
-    const done = parseServerMessage(
-      { type: 'compaction_status', active: false },
-      makeState(),
-      makeCallbacks(),
-      POOL_KEY,
-    );
-    expect(done.tokensUpdate).toEqual({ compacting: false });
-  });
 });
 
 // ─── Inbox ────────────────────────────────────────────────────────────────────
diff --git a/packages/client/src/api-client.ts b/packages/client/src/api-client.ts
index 970d448a..dedb4d02 100644
--- a/packages/client/src/api-client.ts
+++ b/packages/client/src/api-client.ts
@@ -282,6 +282,7 @@ export class MitzoApiClient {
     progress?: { completed: number; total: number } | null;
     specMode?: boolean;
     awaitingApproval?: boolean;
+    spawnEnabled?: boolean;
   }> {
     const res = await this.assertOk(
       await this.fetch('/api/loop/status', { credentials: 'include' }),
@@ -318,6 +319,17 @@ export class MitzoApiClient {
     );
   }
 
+  async setSpawnEnabled(enabled: boolean): Promise<void> {
+    await this.assertOk(
+      await this.fetch('/api/loop/spawn', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        credentials: 'include',
+        body: JSON.stringify({ enabled }),
+      }),
+    );
+  }
+
   async approveSpec(): Promise<void> {
     await this.assertOk(
       await this.fetch('/api/loop/spec/approve', { method: 'POST', credentials: 'include' }),
diff --git a/packages/client/src/protocol-parser.ts b/packages/client/src/protocol-parser.ts
index bf86fb19..be21abb9 100644
--- a/packages/client/src/protocol-parser.ts
+++ b/packages/client/src/protocol-parser.ts
@@ -481,6 +481,7 @@ export function parseServerMessage(
           progress: (msg.progress as LoopStatus['progress']) ?? null,
           specMode: (msg.specMode as boolean) ?? false,
           awaitingApproval: (msg.awaitingApproval as boolean) ?? false,
+          spawnEnabled: (msg.spawnEnabled as boolean) ?? false,
         },
       };
       break;
@@ -516,10 +517,6 @@ export function parseServerMessage(
       break;
     }
 
-    case 'compaction_status':
-      result.tokensUpdate = { compacting: Boolean(msg.active) };
-      break;
-
     // Progress tracking messages
     case 'progress_start':
       result.progressUpdate = {
diff --git a/packages/client/src/slices/tasks.ts b/packages/client/src/slices/tasks.ts
index 55c27c03..f9082d67 100644
--- a/packages/client/src/slices/tasks.ts
+++ b/packages/client/src/slices/tasks.ts
@@ -46,6 +46,7 @@ export interface LoopStatus {
   progress: { done: number; total: number } | null;
   specMode: boolean;
   awaitingApproval: boolean;
+  spawnEnabled: boolean;
 }
 
 export interface TasksState {
@@ -62,5 +63,6 @@ export const INITIAL_TASKS_STATE: TasksState = {
     progress: null,
     specMode: false,
     awaitingApproval: false,
+    spawnEnabled: false,
   },
 };
diff --git a/packages/client/src/slices/tokens.ts b/packages/client/src/slices/tokens.ts
index a981becf..15570d88 100644
--- a/packages/client/src/slices/tokens.ts
+++ b/packages/client/src/slices/tokens.ts
@@ -5,7 +5,6 @@ export interface TokensState {
   numTurns: number;
   turnIndex: number;
   numCompactions: number;
-  compacting: boolean;
 }
 
 export const DEFAULT_CONTEXT_CEILING = 200_000;
@@ -17,5 +16,4 @@ export const INITIAL_TOKENS_STATE: TokensState = {
   numTurns: 0,
   turnIndex: 0,
   numCompactions: 0,
-  compacting: false,
 };
diff --git a/packages/client/src/store.ts b/packages/client/src/store.ts
index acc99340..74c791a8 100644
--- a/packages/client/src/store.ts
+++ b/packages/client/src/store.ts
@@ -115,6 +115,7 @@ export interface MitzoStoreState {
   pauseLoop(): Promise<void>;
   resumeLoop(): Promise<void>;
   stopLoop(): Promise<void>;
+  setSpawnEnabled(enabled: boolean): Promise<void>;
   approveTask(id: string): Promise<void>;
   rejectTask(id: string, feedback: string): Promise<void>;
   approveSpec(): Promise<void>;
@@ -541,6 +542,7 @@ export function createMitzoStore(options: MitzoStoreOptions): StoreApi<MitzoStor
                 progress: (status.progress as LoopStatus['progress']) ?? null,
                 specMode: status.specMode ?? false,
                 awaitingApproval: status.awaitingApproval ?? false,
+                spawnEnabled: status.spawnEnabled ?? false,
               },
             },
           }));
@@ -578,6 +580,17 @@ export function createMitzoStore(options: MitzoStoreOptions): StoreApi<MitzoStor
       await api.stopLoop();
     },
 
+    async setSpawnEnabled(enabled: boolean) {
+      // Optimistic update so the toggle reflects immediately
+      set((s) => ({
+        tasks: {
+          ...s.tasks,
+          loopStatus: { ...s.tasks.loopStatus, spawnEnabled: enabled },
+        },
+      }));
+      await api.setSpawnEnabled(enabled);
+    },
+
     async approveTask(id: string) {
       await api.approveTask(id);
     },
diff --git a/packages/harness/src/session-registry.ts b/packages/harness/src/session-registry.ts
index 31759bce..8f8678ac 100644
--- a/packages/harness/src/session-registry.ts
+++ b/packages/harness/src/session-registry.ts
@@ -155,10 +155,6 @@ export class SessionRegistry {
     return this.sessions.get(clientId);
   }
 
-  keys(): IterableIterator<string> {
-    return this.sessions.keys();
-  }
-
   entries(): IterableIterator<[string, ManagedSession]> {
     return this.sessions.entries();
   }
diff --git a/server/__tests__/session-overview.test.ts b/server/__tests__/session-overview.test.ts
index 934e7acd..429341e9 100644
--- a/server/__tests__/session-overview.test.ts
+++ b/server/__tests__/session-overview.test.ts
@@ -34,6 +34,7 @@ function idleLoopStatus(): LoopStatus {
     progress: null,
     specMode: false,
     awaitingApproval: false,
+    spawnEnabled: false,
   };
 }
 
diff --git a/server/__tests__/task-orchestrator.test.ts b/server/__tests__/task-orchestrator.test.ts
index c722a05b..a3240d67 100644
--- a/server/__tests__/task-orchestrator.test.ts
+++ b/server/__tests__/task-orchestrator.test.ts
@@ -312,19 +312,18 @@ describe('TaskOrchestrator', () => {
 
   describe('orphan detection', () => {
     it('reclaims orphaned tasks during tick', () => {
-      // getActiveSessionIds returns clientIds (not SDK sessionIds)
-      // to match what setSessionId stores on tasks
+      // Create deps with getActiveSessionIds
       const depsWithOrphan = createTestDeps(store);
-      depsWithOrphan.getActiveSessionIds = () => new Set(['alive-client']);
+      depsWithOrphan.getActiveSessionIds = () => new Set(['alive-session']);
       const orch = new TaskOrchestrator(depsWithOrphan);
 
       const goal = store.create({ title: 'Goal' });
       const c1 = store.create({ title: 'Orphan', parentId: goal.id });
       store.create({ title: 'Next', parentId: goal.id });
 
-      // Simulate c1 assigned to dead session (clientId not in active set)
+      // Simulate c1 assigned to dead session
       store.update(c1.id, { status: 'active' });
-      store.setSessionId(c1.id, 'dead-client');
+      store.setSessionId(c1.id, 'dead-session');
 
       orch.start(goal.id);
 
@@ -336,7 +335,7 @@ describe('TaskOrchestrator', () => {
 
     it('does not reclaim tasks with alive sessions', () => {
       const depsWithOrphan = createTestDeps(store);
-      depsWithOrphan.getActiveSessionIds = () => new Set(['alive-client']);
+      depsWithOrphan.getActiveSessionIds = () => new Set(['alive-session']);
       const orch = new TaskOrchestrator(depsWithOrphan);
 
       const goal = store.create({ title: 'Goal' });
@@ -344,7 +343,7 @@ describe('TaskOrchestrator', () => {
       const c2 = store.create({ title: 'Next', parentId: goal.id });
 
       store.update(c1.id, { status: 'active' });
-      store.setSessionId(c1.id, 'alive-client');
+      store.setSessionId(c1.id, 'alive-session');
 
       orch.start(goal.id);
 
@@ -352,33 +351,249 @@ describe('TaskOrchestrator', () => {
       expect(orch.getStatus().activeTaskId).toBe(c2.id);
     });
 
-    it('reclaims spawned task sessions using clientId matching', () => {
-      // Simulates the real scenario: task.session_id stores clientId
-      // (e.g. 'task:abc123'), active set contains clientIds from registry
-      const depsWithOrphan = createTestDeps(store);
-      depsWithOrphan.getActiveSessionIds = () => new Set(['task:alive-wt']);
-      const orch = new TaskOrchestrator(depsWithOrphan);
+    it('clientId namespace: orphan detection must use clientIds not sessionIds', () => {
+      // Reproduces the root cause of the runaway spawn incident:
+      // tasks store clientId (e.g. "headless:abc") but getActiveSessionIds
+      // was returning SDK sessionIds (UUIDs). The IDs never matched, so every
+      // spawned task was always classified as orphaned and re-spawned.
+      const deps = createTestDeps(store);
+      // Simulate a registry that has clientId "headless:abc-123" registered
+      deps.getActiveSessionIds = () => new Set(['headless:abc-123']);
+      const orch = new TaskOrchestrator(deps);
+
+      const goal = store.create({ title: 'Goal' });
+      const task = store.create({ title: 'Spawned task', parentId: goal.id });
+
+      // Simulate what spawnSession does: set task active with clientId
+      store.update(task.id, { status: 'active' });
+      store.setSessionId(task.id, 'headless:abc-123');
+
+      orch.start(goal.id);
+
+      // Task should NOT be reclaimed — its clientId matches the active set
+      expect(store.get(task.id)!.status).toBe('active');
+      expect(store.get(task.id)!.sessionId).toBe('headless:abc-123');
+    });
+
+    it('clientId namespace: reclaims task when clientId is truly gone', () => {
+      const deps = createTestDeps(store);
+      // Registry has different clientIds — "headless:abc-123" is NOT here
+      deps.getActiveSessionIds = () => new Set(['headless:other-session']);
+      const orch = new TaskOrchestrator(deps);
+
+      const goal = store.create({ title: 'Goal' });
+      const task = store.create({ title: 'Dead task', parentId: goal.id });
+
+      store.update(task.id, { status: 'active' });
+      store.setSessionId(task.id, 'headless:abc-123');
+
+      orch.start(goal.id);
+
+      // Task SHOULD be reclaimed — its clientId is not in the active set
+      // and it wasn't recently spawned (no grace period entry)
+      expect(store.get(task.id)!.status).toBe('active'); // reclaimed then re-assigned
+      expect(store.get(task.id)!.sessionId).toBeNull(); // sessionId cleared
+      expect(orch.getStatus().activeTaskId).toBe(task.id);
+    });
+  });
+
+  describe('spawn-orphan loop prevention', () => {
+    it('spawned task is not reclaimed by orphan detection on next tick', async () => {
+      // End-to-end reproduction of the runaway incident:
+      // 1. Orchestrator spawns a session for a task
+      // 2. spawnSession returns clientId, task gets session_id = clientId
+      // 3. Next tick runs orphan detection
+      // 4. Task must NOT be reclaimed (grace period protects it)
+      const spawnedClientId = 'headless:spawn-test-001';
+      const spawnSession = vi.fn().mockResolvedValue(spawnedClientId);
+      const deps = createTestDeps(store);
+      deps.spawnSession = spawnSession;
+      // Simulate registry that does NOT yet have the spawned session
+      // (worst case: session hasn't registered yet)
+      deps.getActiveSessionIds = () => new Set();
+      const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
+
+      const goal = store.create({ title: 'Goal' });
+      const task = store.create({
+        title: 'Review PR',
+        parentId: goal.id,
+        sessionPolicy: 'spawn',
+      });
+
+      orch.start(goal.id);
+
+      // Wait for spawn to complete
+      await vi.waitFor(() => {
+        expect(spawnSession).toHaveBeenCalledTimes(1);
+      });
+
+      // Wait for session_id to be set on the task
+      await vi.waitFor(() => {
+        expect(store.get(task.id)!.sessionId).toBe(spawnedClientId);
+      });
+
+      // Manually trigger another tick — orphan detection runs
+      orch.onTaskCompleted('some-other-task');
+
+      // Task must still be active with its session_id intact
+      // Grace period prevents reclamation even though clientId is not in active set
+      expect(store.get(task.id)!.status).toBe('active');
+      expect(store.get(task.id)!.sessionId).toBe(spawnedClientId);
+
+      // spawnSession must NOT have been called again for this task
+      expect(spawnSession).toHaveBeenCalledTimes(1);
+    });
+
+    it('single task cannot spawn more than one session', async () => {
+      // The incident spawned 50 sessions for 1 task. Even with all safety
+      // layers disabled, one task should produce at most one spawn call.
+      const spawnSession = vi.fn().mockResolvedValue('headless:single-001');
+      const deps = createTestDeps(store);
+      deps.spawnSession = spawnSession;
+      deps.getActiveSessionIds = () => new Set();
+      const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
+
+      const goal = store.create({ title: 'Goal' });
+      store.create({
+        title: 'Single task',
+        parentId: goal.id,
+        sessionPolicy: 'spawn',
+      });
+
+      orch.start(goal.id);
+
+      await vi.waitFor(() => {
+        expect(spawnSession).toHaveBeenCalledTimes(1);
+      });
+
+      // Trigger multiple ticks — none should re-spawn the same task
+      for (let i = 0; i < 10; i++) {
+        orch.onTaskCompleted('trigger-tick');
+      }
+
+      // Still exactly 1 spawn call
+      expect(spawnSession).toHaveBeenCalledTimes(1);
+    });
+
+    it('grace period expires after SPAWN_GRACE_MS, allowing reclamation', async () => {
+      vi.useFakeTimers();
+      const baseTime = Date.now();
+
+      const spawnSession = vi.fn().mockResolvedValue('headless:grace-001');
+      const deps = createTestDeps(store);
+      deps.spawnSession = spawnSession;
+      deps.getActiveSessionIds = () => new Set(); // session never appears
+      const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
+
+      const goal = store.create({ title: 'Goal' });
+      const task = store.create({
+        title: 'Will expire',
+        parentId: goal.id,
+        sessionPolicy: 'spawn',
+      });
+
+      orch.start(goal.id);
+
+      // Flush microtasks so the spawn callback resolves
+      await vi.advanceTimersByTimeAsync(0);
+      expect(spawnSession).toHaveBeenCalledTimes(1);
+      expect(store.get(task.id)!.sessionId).toBe('headless:grace-001');
+
+      // Advance past the 60s grace period
+      vi.setSystemTime(baseTime + 61_000);
+
+      // Orchestrator paused after spawning (no more pending tasks).
+      // Resume triggers tick → orphan detection should now reclaim.
+      orch.resume();
+
+      // Task should have been reclaimed — session_id cleared
+      const updated = store.get(task.id)!;
+      expect(updated.sessionId).not.toBe('headless:grace-001');
+
+      vi.useRealTimers();
+    });
+
+    it('rate limiter blocks respawn even if task is reclaimed', async () => {
+      // Saturate the rate limiter, then verify a reclaimed task
+      // cannot trigger another spawn.
+      const spawnSession = vi.fn().mockResolvedValue('headless:rate-limit');
+      const deps = createTestDeps(store);
+      deps.spawnSession = spawnSession;
+      deps.getActiveSessionIds = () => new Set(); // everything looks orphaned
+      const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
 
       const goal = store.create({ title: 'Goal' });
-      const orphan = store.create({ title: 'Dead spawn', parentId: goal.id });
-      const alive = store.create({ title: 'Alive spawn', parentId: goal.id });
-      store.create({ title: 'Pending', parentId: goal.id });
+      // Create 5 tasks to saturate the rate limiter
+      for (let i = 0; i < 5; i++) {
+        store.create({
+          title: `Task ${i}`,
+          parentId: goal.id,
+          sessionPolicy: 'spawn',
+        });
+      }
+      // Create the task that should be blocked
+      const victim = store.create({
+        title: 'Should be blocked',
+        parentId: goal.id,
+        sessionPolicy: 'spawn',
+      });
 
-      // Orphan: session ended, clientId no longer in registry
-      store.update(orphan.id, { status: 'active' });
-      store.setSessionId(orphan.id, 'task:dead-wt');
+      orch.start(goal.id);
+
+      await vi.waitFor(() => {
+        expect(spawnSession).toHaveBeenCalledTimes(5);
+      });
+
+      // The 6th task (victim) should NOT have been spawned
+      expect(store.get(victim.id)!.status).toBe('pending');
+      expect(store.get(victim.id)!.sessionId).toBeNull();
+
+      // Trigger more ticks — still blocked by rate limiter
+      orch.onTaskCompleted('trigger');
+      expect(spawnSession).toHaveBeenCalledTimes(5);
+    });
 
-      // Alive: session still running
-      store.update(alive.id, { status: 'active' });
-      store.setSessionId(alive.id, 'task:alive-wt');
+    it('rate limiter schedules retry after window expires', async () => {
+      vi.useFakeTimers();
+
+      const spawnSession = vi.fn().mockResolvedValue('headless:retry');
+      const deps = createTestDeps(store);
+      deps.spawnSession = spawnSession;
+      const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
+
+      const goal = store.create({ title: 'Goal' });
+      // Create 6 tasks — 5 will spawn (depth-limited), 6th deferred
+      for (let i = 0; i < 6; i++) {
+        store.create({
+          title: `Task ${i}`,
+          parentId: goal.id,
+          sessionPolicy: 'spawn',
+        });
+      }
 
       orch.start(goal.id);
 
-      // Orphan should be reclaimed and re-dispatched
-      expect(store.get(orphan.id)!.sessionId).toBeNull();
-      // Alive should NOT be reclaimed
-      expect(store.get(alive.id)!.sessionId).toBe('task:alive-wt');
-      expect(store.get(alive.id)!.status).toBe('active');
+      // Flush microtasks to let spawns resolve
+      await vi.advanceTimersByTimeAsync(0);
+      expect(spawnSession).toHaveBeenCalledTimes(5);
+
+      // Trigger a new tick chain — depth resets but rate limiter blocks the 6th task
+      // and schedules a retry timer
+      orch.onTaskCompleted('trigger');
+      expect(spawnSession).toHaveBeenCalledTimes(5); // still blocked
+
+      // Advance past the rate limit window — retry timer should fire
+      await vi.advanceTimersByTimeAsync(61_000);
+
+      // The 6th task should now be spawned
+      expect(spawnSession).toHaveBeenCalledTimes(6);
+
+      vi.useRealTimers();
     });
   });
 
@@ -452,6 +667,7 @@ describe('TaskOrchestrator', () => {
       const deps = createTestDeps(store);
       deps.watchSignal = watchSignal;
       const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
 
       const goal = store.create({ title: 'Goal' });
       store.create({
@@ -477,6 +693,7 @@ describe('TaskOrchestrator', () => {
     it('human_review tasks go to pending_review immediately', () => {
       const deps = createTestDeps(store);
       const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
 
       const goal = store.create({ title: 'Goal' });
       store.create({
@@ -495,6 +712,7 @@ describe('TaskOrchestrator', () => {
     it('agent_work tasks behave as before (assign to session)', () => {
       const deps = createTestDeps(store);
       const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
 
       const goal = store.create({ title: 'Goal' });
       store.create({
@@ -513,6 +731,7 @@ describe('TaskOrchestrator', () => {
     it('null stageType tasks behave as agent_work (backwards compat)', () => {
       const deps = createTestDeps(store);
       const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
 
       const goal = store.create({ title: 'Goal' });
       store.create({ title: 'Legacy task', parentId: goal.id });
@@ -529,6 +748,7 @@ describe('TaskOrchestrator', () => {
       const deps = createTestDeps(store);
       deps.watchSignal = watchSignal;
       const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
 
       const goal = store.create({ title: 'Workflow Goal' });
       const agent = store.create({
@@ -587,6 +807,7 @@ describe('TaskOrchestrator', () => {
       const deps = createTestDeps(store);
       deps.spawnSession = spawnSession;
       const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
 
       const goal = store.create({ title: 'Goal' });
       store.create({
@@ -611,6 +832,7 @@ describe('TaskOrchestrator', () => {
       const deps = createTestDeps(store);
       deps.spawnSession = spawnSession;
       const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
 
       const goal = store.create({ title: 'Goal' });
       store.create({
@@ -627,6 +849,7 @@ describe('TaskOrchestrator', () => {
     it('falls back to pinned session when spawnSession is not provided', () => {
       const deps = createTestDeps(store);
       const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
 
       const goal = store.create({ title: 'Goal' });
       const task = store.create({
@@ -646,6 +869,7 @@ describe('TaskOrchestrator', () => {
       const deps = createTestDeps(store);
       deps.spawnSession = spawnSession;
       const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
 
       const goal = store.create({ title: 'Goal' });
       const task = store.create({
@@ -664,6 +888,7 @@ describe('TaskOrchestrator', () => {
       const deps = createTestDeps(store);
       deps.spawnSession = spawnSession;
       const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
 
       const goal = store.create({ title: 'Goal' });
       const task = store.create({
@@ -688,6 +913,7 @@ describe('TaskOrchestrator', () => {
       const deps = createTestDeps(store);
       deps.spawnSession = spawnSession;
       const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
 
       const goal = store.create({ title: 'Goal' });
       const task = store.create({
@@ -716,6 +942,7 @@ describe('TaskOrchestrator', () => {
       const deps = createTestDeps(store);
       deps.spawnSession = spawnSession;
       const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
 
       const goal = store.create({ title: 'Goal' });
       store.create({
@@ -748,6 +975,7 @@ describe('TaskOrchestrator', () => {
       const deps = createTestDeps(store);
       deps.spawnSession = spawnSession;
       const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
 
       const goal1 = store.create({ title: 'Goal 1' });
       store.create({
@@ -792,6 +1020,7 @@ describe('TaskOrchestrator', () => {
       const deps = createTestDeps(store);
       deps.spawnSession = spawnSession;
       const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
 
       const goal = store.create({ title: 'Goal' });
       store.create({
@@ -831,6 +1060,7 @@ describe('TaskOrchestrator', () => {
       const deps = createTestDeps(store);
       deps.spawnSession = spawnSession;
       const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
 
       const goal = store.create({ title: 'Goal' });
       store.create({
@@ -856,6 +1086,7 @@ describe('TaskOrchestrator', () => {
       const deps = createTestDeps(store);
       deps.spawnSession = spawnSession;
       const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
 
       const goal = store.create({ title: 'Goal' });
       // No explicit sessionPolicy — store defaults to 'auto'
@@ -869,34 +1100,41 @@ describe('TaskOrchestrator', () => {
       expect(deps.setTaskContext).not.toHaveBeenCalled();
     });
 
-    it('does not call setTaskContext (pinned) for spawned sessions', async () => {
-      const spawnSession = vi.fn().mockResolvedValue('spawned-client-1');
+    it('respects spawn depth limit of 5', async () => {
+      const spawnSession = vi.fn().mockResolvedValue('spawned-client');
       const deps = createTestDeps(store);
       deps.spawnSession = spawnSession;
       const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
 
       const goal = store.create({ title: 'Goal' });
-      store.create({
-        title: 'Spawn task',
-        parentId: goal.id,
-        sessionPolicy: 'spawn',
-      });
+      // Create 10 spawn tasks — only 5 should fire per tick chain
+      for (let i = 0; i < 10; i++) {
+        store.create({
+          title: `Spawn task ${i}`,
+          parentId: goal.id,
+          sessionPolicy: 'spawn',
+        });
+      }
 
       orch.start(goal.id);
 
       await vi.waitFor(() => {
-        expect(spawnSession).toHaveBeenCalled();
+        expect(spawnSession).toHaveBeenCalledTimes(5);
       });
 
-      // Spawned sessions get taskContext via startChat options, not setTaskContext
-      expect(deps.setTaskContext).not.toHaveBeenCalled();
+      // Should NOT have spawned more than 5
+      expect(spawnSession).toHaveBeenCalledTimes(5);
     });
 
-    it('falls back to setTaskContext (pinned) when spawn returns null', async () => {
-      const spawnSession = vi.fn().mockResolvedValue(null);
+    it('orphan detection skips recently-spawned tasks (grace period)', async () => {
+      const spawnSession = vi.fn().mockResolvedValue('spawned-client-1');
       const deps = createTestDeps(store);
       deps.spawnSession = spawnSession;
+      // Return empty active set — everything looks orphaned
+      deps.getActiveSessionIds = () => new Set();
       const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
 
       const goal = store.create({ title: 'Goal' });
       const task = store.create({
@@ -908,171 +1146,245 @@ describe('TaskOrchestrator', () => {
       orch.start(goal.id);
 
       await vi.waitFor(() => {
-        expect(deps.setTaskContext).toHaveBeenCalledWith(task.id, goal.id);
+        expect(spawnSession).toHaveBeenCalledTimes(1);
       });
+
+      // Manually trigger tick — orphan detection should skip this task
+      // because it was spawned within the grace period
+      orch.onTaskCompleted(task.id);
+
+      // Should still only be 1 spawn call — the task wasn't reclaimed
+      expect(spawnSession).toHaveBeenCalledTimes(1);
+      // Task should still be active, not reset to pending
+      expect(store.get(task.id)!.status).toBe('active');
     });
 
-    it('tick after spawn session completes advances workflow', async () => {
-      const spawnSession = vi.fn().mockResolvedValue('task:spawned-1');
+    it('rate limits spawns across tick chains', async () => {
+      const spawnSession = vi.fn().mockResolvedValue('spawned-client');
       const deps = createTestDeps(store);
       deps.spawnSession = spawnSession;
-      let activeClients = new Set(['task:spawned-1']);
-      deps.getActiveSessionIds = () => activeClients;
       const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
 
       const goal = store.create({ title: 'Goal' });
-      const t1 = store.create({ title: 'Spawn task', parentId: goal.id });
-      const t2 = store.create({ title: 'Next task', parentId: goal.id, sessionPolicy: 'reuse' });
+      for (let i = 0; i < 10; i++) {
+        store.create({
+          title: `Task ${i}`,
+          parentId: goal.id,
+          sessionPolicy: 'spawn',
+        });
+      }
 
       orch.start(goal.id);
 
+      // Wait for first tick chain to complete
       await vi.waitFor(() => {
-        expect(spawnSession).toHaveBeenCalled();
+        expect(spawnSession).toHaveBeenCalledTimes(5);
+      });
+
+      // Trigger another tick chain — rate limit should still block
+      orch.onTaskCompleted('nonexistent');
+
+      // Still only 5 — rate limit window hasn't expired
+      expect(spawnSession).toHaveBeenCalledTimes(5);
+    });
+
+    it('reuse policy tasks use pinned session as before', () => {
+      const spawnSession = vi.fn().mockResolvedValue('spawned-client-1');
+      const deps = createTestDeps(store);
+      deps.spawnSession = spawnSession;
+      const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
+
+      const goal = store.create({ title: 'Goal' });
+      const task = store.create({
+        title: 'Reuse task',
+        parentId: goal.id,
+        sessionPolicy: 'reuse',
       });
 
-      // Agent completed the task during the session
-      store.update(t1.id, { status: 'done' });
-      store.cascadeStatus(t1.id);
+      orch.start(goal.id);
 
-      // .finally() fires: session removed from registry, tick() called directly
-      activeClients = new Set();
-      orch.tick();
+      expect(spawnSession).not.toHaveBeenCalled();
+      expect(orch.getStatus().activeTaskId).toBe(task.id);
+      expect(deps.setTaskContext).toHaveBeenCalledWith(task.id, goal.id);
+    });
+  });
 
-      // t2 should now be active (workflow advanced)
-      expect(store.get(t2.id)!.status).toBe('active');
-      expect(orch.getStatus().activeTaskId).toBe(t2.id);
+  describe('spawn kill switch', () => {
+    it('defaults to spawnEnabled=false', () => {
+      expect(orchestrator.spawnEnabled).toBe(false);
+      expect(orchestrator.getStatus().spawnEnabled).toBe(false);
     });
 
-    it('resume after spawn session dies reclaims unfinished task', async () => {
-      // Primary scenario for .finally(): session crashes without calling
-      // TaskComplete. The task stays active but the session is gone.
-      // After all tasks are spawned, the orchestrator pauses (no pending left).
-      // .finally() calls resume() → tick() → orphan reclaim → re-dispatch.
-      const spawnSession = vi.fn().mockResolvedValue('task:spawned-1');
+    it('setSpawnEnabled toggles the flag and broadcasts', () => {
+      orchestrator.setSpawnEnabled(true);
+      expect(orchestrator.spawnEnabled).toBe(true);
+      expect(broadcastedStatuses.at(-1)?.spawnEnabled).toBe(true);
+
+      orchestrator.setSpawnEnabled(false);
+      expect(orchestrator.spawnEnabled).toBe(false);
+      expect(broadcastedStatuses.at(-1)?.spawnEnabled).toBe(false);
+    });
+
+    it('forces reuse policy when spawning is disabled', () => {
+      const spawnSession = vi.fn().mockResolvedValue('headless:test');
       const deps = createTestDeps(store);
       deps.spawnSession = spawnSession;
-      let activeClients = new Set(['task:spawned-1']);
-      deps.getActiveSessionIds = () => activeClients;
       const orch = new TaskOrchestrator(deps);
 
+      // spawnEnabled defaults to false — spawn should NOT be called
       const goal = store.create({ title: 'Goal' });
-      store.create({ title: 'Spawn task', parentId: goal.id });
+      store.create({ title: 'Task', parentId: goal.id });
 
       orch.start(goal.id);
 
-      await vi.waitFor(() => {
-        expect(spawnSession).toHaveBeenCalledTimes(1);
-      });
+      expect(spawnSession).not.toHaveBeenCalled();
+      // Task should be assigned to pinned session (reuse path)
+      expect(orch.getStatus().activeTaskId).not.toBeNull();
+      expect(deps.setTaskContext).toHaveBeenCalled();
+    });
 
-      // Orchestrator should be paused (all tasks active, none pending)
-      expect(orch.getStatus().state).toBe('paused');
+    it('allows spawning when enabled', async () => {
+      const spawnSession = vi.fn().mockResolvedValue('headless:enabled');
+      const deps = createTestDeps(store);
+      deps.spawnSession = spawnSession;
+      const orch = new TaskOrchestrator(deps);
 
-      // Verify the task is active and has sessionId set (pre-condition for orphan reclaim)
-      const task = store.getChildren(goal.id)[0];
-      expect(store.get(task.id)!.status).toBe('active');
-      expect(store.get(task.id)!.sessionId).toBe('task:spawned-1');
+      orch.setSpawnEnabled(true);
 
-      // .finally() fires: session removed from registry, resume() called
-      activeClients = new Set();
-      orch.resume();
+      const goal = store.create({ title: 'Goal' });
+      store.create({ title: 'Task', parentId: goal.id });
 
-      // Orphan reclaim detected the dead session and re-dispatched the task
+      orch.start(goal.id);
+
+      // Spawn should be called when enabled
       await vi.waitFor(() => {
-        expect(spawnSession).toHaveBeenCalledTimes(2);
+        expect(spawnSession).toHaveBeenCalled();
       });
     });
 
-    it('tick is a no-op when orchestrator is stopped before session ends', async () => {
-      // Edge case: orchestrator stopped (idle) while a spawned session is
-      // still in-flight. .finally() fires → tick() → returns early (guarded
-      // by state !== 'running'). No crash, no side effects.
-      const spawnSession = vi.fn().mockResolvedValue('task:spawned-1');
+    it('can be toggled while loop is running', () => {
+      const spawnSession = vi.fn().mockResolvedValue('headless:toggle');
       const deps = createTestDeps(store);
       deps.spawnSession = spawnSession;
-      // Return spawned clientId while session is alive
-      let activeClients = new Set(['task:spawned-1']);
-      deps.getActiveSessionIds = () => activeClients;
       const orch = new TaskOrchestrator(deps);
 
+      // Start with spawning disabled — task uses reuse path
       const goal = store.create({ title: 'Goal' });
-      const t1 = store.create({ title: 'Spawn task', parentId: goal.id });
+      store.create({ title: 'Task 1', parentId: goal.id });
+      store.create({ title: 'Task 2', parentId: goal.id });
+
+      orch.start(goal.id);
+
+      // With spawn disabled, task 1 should use pinned session (reuse)
+      expect(spawnSession).not.toHaveBeenCalled();
+      const task1Id = orch.getStatus().activeTaskId;
+      expect(task1Id).not.toBeNull();
+
+      // Enable spawning mid-loop, complete task 1
+      orch.setSpawnEnabled(true);
+      store.update(task1Id!, { status: 'done' });
+      store.cascadeStatus(task1Id!);
+      orch.onTaskCompleted(task1Id!);
 
+      // Task 2 should now spawn (enabled)
+      expect(spawnSession).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  describe('spawn state cleanup', () => {
+    it('stop() clears spawn tracking state', async () => {
+      const spawnSession = vi.fn().mockResolvedValue('spawned-client-1');
+      const deps = createTestDeps(store);
+      deps.spawnSession = spawnSession;
+      deps.getActiveSessionIds = vi.fn().mockReturnValue(new Set(['headless:spawned-client-1']));
+      const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
+
+      const goal = store.create({ title: 'Goal' });
+      store.create({ title: 'Task 1', parentId: goal.id, sessionPolicy: 'spawn' });
       orch.start(goal.id);
 
+      // Wait for spawn
       await vi.waitFor(() => {
         expect(spawnSession).toHaveBeenCalledTimes(1);
       });
 
-      // User stops the orchestrator while session is still running
+      // Stop should clear all spawn tracking
       orch.stop();
-      expect(orch.getStatus().state).toBe('idle');
 
-      // .finally() fires after session ends — tick is a no-op in idle state
-      activeClients = new Set();
-      orch.tick();
+      // Start a new goal — should not be affected by previous spawn state
+      spawnSession.mockClear();
+      const goal2 = store.create({ title: 'Goal 2' });
+      store.create({ title: 'Task 2', parentId: goal2.id, sessionPolicy: 'spawn' });
+      orch.start(goal2.id);
 
-      expect(orch.getStatus().state).toBe('idle');
-      expect(store.get(t1.id)?.status).toBe('active'); // unchanged
-      expect(spawnSession).toHaveBeenCalledTimes(1); // no re-dispatch
+      // Task 2 should spawn without rate-limit interference from goal 1
+      await vi.waitFor(() => {
+        expect(spawnSession).toHaveBeenCalledTimes(1);
+      });
     });
 
-    it('does not advance old goal when orchestrator moved to a new goal', async () => {
-      const spawnSession = vi.fn().mockResolvedValue('task:spawned-1');
+    it('start() clears spawn tracking from previous paused goal', async () => {
+      const spawnSession = vi.fn().mockResolvedValue('spawned-client-1');
       const deps = createTestDeps(store);
       deps.spawnSession = spawnSession;
-      let activeClients = new Set(['task:spawned-1']);
-      deps.getActiveSessionIds = () => activeClients;
+      deps.getActiveSessionIds = vi.fn().mockReturnValue(new Set(['headless:spawned-client-1']));
       const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
 
-      const goal1 = store.create({ title: 'Goal 1' });
-      store.create({ title: 'Spawn task', parentId: goal1.id });
-
-      const goal2 = store.create({ title: 'Goal 2' });
-      const g2task = store.create({
-        title: 'Reuse task',
-        parentId: goal2.id,
-        sessionPolicy: 'reuse',
-      });
-
-      orch.start(goal1.id);
+      const goal = store.create({ title: 'Goal' });
+      store.create({ title: 'Task 1', parentId: goal.id, sessionPolicy: 'spawn' });
+      orch.start(goal.id);
 
       await vi.waitFor(() => {
         expect(spawnSession).toHaveBeenCalledTimes(1);
       });
 
-      // User switches to a new goal while spawned session is still running
-      orch.stop();
-      orch.start(goal2.id);
-      expect(orch.getStatus().goalId).toBe(goal2.id);
-      expect(orch.getStatus().activeTaskId).toBe(g2task.id);
+      // Pause, then start a new goal without stopping
+      orch.pause();
+      spawnSession.mockClear();
 
-      // Old spawned session ends — tick should NOT interfere with goal2
-      activeClients = new Set();
-      orch.tick();
+      const goal2 = store.create({ title: 'Goal 2' });
+      store.create({ title: 'Task 2', parentId: goal2.id, sessionPolicy: 'spawn' });
+      orch.start(goal2.id);
 
-      // Goal2 state should be unchanged
-      expect(orch.getStatus().goalId).toBe(goal2.id);
-      expect(orch.getStatus().activeTaskId).toBe(g2task.id);
+      // Should spawn cleanly — no stale rate-limit data from goal 1
+      await vi.waitFor(() => {
+        expect(spawnSession).toHaveBeenCalledTimes(1);
+      });
     });
 
-    it('reuse policy tasks use pinned session as before', () => {
+    it('disabling spawn mid-loop stops new spawns but keeps in-flight tasks', async () => {
       const spawnSession = vi.fn().mockResolvedValue('spawned-client-1');
       const deps = createTestDeps(store);
       deps.spawnSession = spawnSession;
+      deps.getActiveSessionIds = vi.fn().mockReturnValue(new Set(['headless:spawned-client-1']));
       const orch = new TaskOrchestrator(deps);
+      orch.setSpawnEnabled(true);
 
       const goal = store.create({ title: 'Goal' });
-      const task = store.create({
-        title: 'Reuse task',
-        parentId: goal.id,
-        sessionPolicy: 'reuse',
-      });
+      const task1 = store.create({ title: 'Task 1', parentId: goal.id, sessionPolicy: 'spawn' });
 
       orch.start(goal.id);
 
-      expect(spawnSession).not.toHaveBeenCalled();
-      expect(orch.getStatus().activeTaskId).toBe(task.id);
-      expect(deps.setTaskContext).toHaveBeenCalledWith(task.id, goal.id);
+      // Task 1 spawns
+      await vi.waitFor(() => {
+        expect(spawnSession).toHaveBeenCalledTimes(1);
+      });
+
+      // Disable spawning while task 1 is in-flight, then add task 2
+      orch.setSpawnEnabled(false);
+      store.create({ title: 'Task 2', parentId: goal.id, sessionPolicy: 'spawn' });
+
+      // Complete task 1 — task 2 should use reuse path, not spawn
+      store.update(task1.id, { status: 'done' });
+      store.cascadeStatus(task1.id);
+      orch.onTaskCompleted(task1.id);
+
+      // No additional spawn — task 2 falls back to reuse policy
+      expect(spawnSession).toHaveBeenCalledTimes(1);
     });
   });
 });
diff --git a/server/__tests__/task-routes.test.ts b/server/__tests__/task-routes.test.ts
index 3aea83a1..fc197d62 100644
--- a/server/__tests__/task-routes.test.ts
+++ b/server/__tests__/task-routes.test.ts
@@ -1,4 +1,4 @@
-import { describe, it, expect, vi, beforeAll, afterAll } from 'vitest';
+import { describe, it, expect, vi, beforeAll, afterAll, afterEach } from 'vitest';
 import type { Express } from 'express';
 import request from 'supertest';
 import { mkdirSync, rmSync } from 'fs';
@@ -225,3 +225,69 @@ describe('task routes', () => {
     expect(res.status).toBe(404);
   });
 });
+
+describe('POST /api/loop/spawn', () => {
+  afterEach(async () => {
+    // Reset orchestrator to null after each test
+    const mod = await import('../app.js');
+    (mod as unknown as { setOrchestrator: (o: unknown) => void }).setOrchestrator(null as never);
+  });
+
+  it('returns 503 when orchestrator is not initialized', async () => {
+    const res = await request(app)
+      .post('/api/loop/spawn')
+      .send({ enabled: true })
+      .set('Cookie', authCookie);
+    expect(res.status).toBe(503);
+    expect(res.body.error).toMatch(/Orchestrator/i);
+  });
+
+  it('returns 400 when enabled is missing', async () => {
+    const mod = await import('../app.js');
+    mod.setOrchestrator({ setSpawnEnabled: vi.fn(), getStatus: vi.fn() } as never);
+
+    const res = await request(app).post('/api/loop/spawn').send({}).set('Cookie', authCookie);
+    expect(res.status).toBe(400);
+    expect(res.body.error).toMatch(/enabled/i);
+  });
+
+  it('returns 400 when enabled is not a boolean', async () => {
+    const mod = await import('../app.js');
+    mod.setOrchestrator({ setSpawnEnabled: vi.fn(), getStatus: vi.fn() } as never);
+
+    const res = await request(app)
+      .post('/api/loop/spawn')
+      .send({ enabled: 'yes' })
+      .set('Cookie', authCookie);
+    expect(res.status).toBe(400);
+  });
+
+  it('sets spawn enabled and returns status', async () => {
+    const mockStatus = {
+      state: 'idle',
+      goalId: null,
+      activeTaskId: null,
+      progress: null,
+      specMode: false,
+      awaitingApproval: false,
+      spawnEnabled: true,
+    };
+    const mod = await import('../app.js');
+    mod.setOrchestrator({
+      setSpawnEnabled: vi.fn(),
+      getStatus: vi.fn().mockReturnValue(mockStatus),
+    } as never);
+
+    const res = await request(app)
+      .post('/api/loop/spawn')
+      .send({ enabled: true })
+      .set('Cookie', authCookie);
+    expect(res.status).toBe(200);
+    expect(res.body.spawnEnabled).toBe(true);
+  });
+
+  it('returns 401 when unauthenticated', async () => {
+    const res = await request(app).post('/api/loop/spawn').send({ enabled: true });
+    expect(res.status).toBe(401);
+  });
+});
diff --git a/server/__tests__/token-update.test.ts b/server/__tests__/token-update.test.ts
index 5240b246..6e9ad8ab 100644
--- a/server/__tests__/token-update.test.ts
+++ b/server/__tests__/token-update.test.ts
@@ -389,24 +389,6 @@ describe('token_update emission', () => {
       },
       { type: 'stream_event', event: { type: 'content_block_stop', index: 0 } },
       { type: 'assistant', message: { content: [] }, session_id: 'sess-compact' },
-      // SDK compaction content block — start, delta, stop
-      {
-        type: 'stream_event',
-        event: {
-          type: 'content_block_start',
-          index: 1,
-          content_block: { type: 'compaction' },
-        },
-      },
-      {
-        type: 'stream_event',
-        event: {
-          type: 'content_block_delta',
-          index: 1,
-          delta: { type: 'compaction_delta', content: 'Summary of prior context...' },
-        },
-      },
-      { type: 'stream_event', event: { type: 'content_block_stop', index: 1 } },
       // SDK system status: compaction completed
       {
         type: 'system',
@@ -447,59 +429,6 @@ describe('token_update emission', () => {
     // The final token_update should include numCompactions: 1
     const last = tokenUpdates[tokenUpdates.length - 1];
     expect(last).toMatchObject({ numCompactions: 1 });
-
-    // compaction_status events should bracket the compaction
-    const compactionStatuses = transport.sent.filter((m) => m.type === 'compaction_status');
-    expect(compactionStatuses).toHaveLength(2);
-    expect(compactionStatuses[0]).toMatchObject({ type: 'compaction_status', active: true });
-    expect(compactionStatuses[1]).toMatchObject({ type: 'compaction_status', active: false });
-  });
-
-  it('resets compacting flag on result when success signal is missing', async () => {
-    const events: Record<string, unknown>[] = [
-      {
-        type: 'stream_event',
-        parent_tool_use_id: null,
-        event: {
-          type: 'message_start',
-          message: { id: 'msg-crash', usage: { input_tokens: 180000 } },
-        },
-      },
-      {
-        type: 'stream_event',
-        event: { type: 'content_block_start', index: 0, content_block: { type: 'text' } },
-      },
-      { type: 'stream_event', event: { type: 'content_block_stop', index: 0 } },
-      { type: 'assistant', message: { content: [] }, session_id: 'sess-crash' },
-      // Compaction starts but SDK never sends compact_result: 'success'
-      {
-        type: 'stream_event',
-        event: {
-          type: 'content_block_start',
-          index: 1,
-          content_block: { type: 'compaction' },
-        },
-      },
-      { type: 'stream_event', event: { type: 'content_block_stop', index: 1 } },
-      // Result arrives directly — no compact_result system message
-      {
-        type: 'result',
-        session_id: 'sess-crash',
-        usage: { input_tokens: 180000, output_tokens: 500 },
-        total_cost_usd: 0.01,
-        num_turns: 1,
-        duration_ms: 3000,
-        duration_api_ms: 2000,
-      },
-    ];
-
-    await runQueryLoop(eventStream(events), clientId, registry, abortController);
-
-    const compactionStatuses = transport.sent.filter((m) => m.type === 'compaction_status');
-    // Should have active:true from block_start and active:false from safety reset
-    expect(compactionStatuses).toHaveLength(2);
-    expect(compactionStatuses[0]).toMatchObject({ active: true });
-    expect(compactionStatuses[1]).toMatchObject({ active: false });
   });
 
   it('handles missing usage on message_start gracefully', async () => {
diff --git a/server/app.ts b/server/app.ts
index 72bd0f9e..4ffc1e0d 100644
--- a/server/app.ts
+++ b/server/app.ts
@@ -791,12 +791,27 @@ app.get('/api/loop/status', (req, res) => {
       progress: null,
       specMode: false,
       awaitingApproval: false,
+      spawnEnabled: false,
     });
     return;
   }
   res.json(orchestrator.getStatus());
 });
 
+app.post('/api/loop/spawn', (req, res) => {
+  if (!orchestrator) {
+    res.status(503).json({ error: 'Orchestrator not initialized' });
+    return;
+  }
+  const { enabled } = req.body ?? {};
+  if (typeof enabled !== 'boolean') {
+    res.status(400).json({ error: 'enabled (boolean) is required' });
+    return;
+  }
+  orchestrator.setSpawnEnabled(enabled);
+  res.json(orchestrator.getStatus());
+});
+
 app.post('/api/loop/start', (req, res) => {
   const body = LoopStartBody.safeParse(req.body);
   if (!body.success) {
diff --git a/server/chat.ts b/server/chat.ts
index 0a8e681b..50579b77 100644
--- a/server/chat.ts
+++ b/server/chat.ts
@@ -745,7 +745,6 @@ export async function startChat(
     onSessionResolved?: (sessionId: string) => void;
     telosTaskId?: string;
     agentName?: string;
-    taskContext?: { currentTaskId: string; goalId: string };
   },
 ) {
   return withSpanAsync(
@@ -776,7 +775,6 @@ async function _startChatInner(
     onSessionResolved?: (sessionId: string) => void;
     telosTaskId?: string;
     agentName?: string;
-    taskContext?: { currentTaskId: string; goalId: string };
   },
 ) {
   const abortController = new AbortController();
@@ -864,9 +862,6 @@ async function _startChatInner(
   const session = registry.get(clientId)!;
   session.model = options.model ?? session.model;
   session.inputQueue = inputQueue as { push: (msg: unknown) => void; close: () => void };
-  if (options.taskContext) {
-    session.taskContext = options.taskContext;
-  }
   _onSessionChange?.(clientId, 'start');
 
   // Session state machine: mark CREATED (Phase 1 — write only, no behavior change)
diff --git a/server/index.ts b/server/index.ts
index c1d56bb1..06b7ae64 100644
--- a/server/index.ts
+++ b/server/index.ts
@@ -236,11 +236,15 @@ const orchestrator = new TaskOrchestrator({
   },
   getActiveSessionIds: () => {
     // Return clientIds — task.session_id stores clientId, not SDK sessionId.
-    // Using sessionId here caused orphan detection to never match spawned tasks.
-    return new Set(registry.keys());
+    // Using sessionId here caused every spawned task to look orphaned (ID namespace mismatch).
+    const ids = new Set<string>();
+    for (const [clientId] of registry.entries()) {
+      ids.add(clientId);
+    }
+    return ids;
   },
   spawnSession: async (taskId: string, prompt: string, goalId: string) => {
-    const clientId = `task:${generateWtId()}`;
+    const clientId = `headless:${generateWtId()}`;
 
     try {
       const transport = new NullTransport();
@@ -252,51 +256,17 @@ const orchestrator = new TaskOrchestrator({
         mode: 'agent',
         isolation: true,
         telosTaskId: goalId,
-        taskContext: { currentTaskId: taskId, goalId },
         onSessionResolved: (sessionId) => {
-          log.info('task session resolved', { taskId, sessionId, clientId });
+          log.info('spawned headless session resolved', { taskId, sessionId, clientId });
           sseRegistry.broadcast('sessions_changed', {});
         },
-      })
-        .catch((err) => {
-          log.error('task session failed', {
-            taskId,
-            clientId,
-            error: (err as Error).message,
-          });
-        })
-        .finally(() => {
-          // Session ended (success or failure) — clean up registry entry
-          // (no WS close to trigger normal removal) and advance the
-          // orchestrator so orphan reclaim picks up unfinished tasks.
-          registry.remove(clientId);
-          // Only advance if the orchestrator is still on the same goal.
-          // A user may have paused manually or started a new goal while
-          // this session was in-flight — don't override that.
-          if (!orchestratorRef) return;
-          try {
-            const status = orchestratorRef.getStatus();
-            if (status.goalId === goalId) {
-              if (status.state === 'paused') {
-                orchestratorRef.resume();
-              } else {
-                orchestratorRef.tick();
-              }
-            } else {
-              log.info('task session ended after loop stopped or goal changed', {
-                taskId,
-                clientId,
-                goalId,
-              });
-            }
-          } catch (err: unknown) {
-            log.error('orchestrator advance failed after task session end', {
-              taskId,
-              clientId,
-              error: err instanceof Error ? err.message : String(err),
-            });
-          }
+      }).catch((err) => {
+        log.error('spawned session failed', {
+          taskId,
+          clientId,
+          error: (err as Error).message,
         });
+      });
 
       return clientId;
     } catch (err) {
diff --git a/server/query-loop.ts b/server/query-loop.ts
index efe41b90..3b2f21ba 100644
--- a/server/query-loop.ts
+++ b/server/query-loop.ts
@@ -278,7 +278,6 @@ async function _runQueryLoopInner(
   let agentContextTokens = 0; // full context window size (input + cached) from parent message_start
   let turnIndex = 0; // increments on each parent message_start (excludes sub-agents)
   let numCompactions = 0; // counts successful compaction events from SDK
-  let compacting = false; // true while SDK is actively compacting context
   let liveSessionTokens = 0; // cumulative total across all API calls in this query
   let cumulativeOutputTokens = 0; // accumulated output tokens (fresh per API call)
   const sessionStartedAt = Date.now(); // wall-clock start for fallback duration
@@ -570,16 +569,6 @@ async function _runQueryLoopInner(
           currentSession.cumulativeSessionTokens = Math.max(sdkTokens, liveSessionTokens);
           currentSession.cumulativeCostUsd = usageData.totalCostUsd;
 
-          // Safety: if compaction was in progress but never completed (SDK crash,
-          // abort, etc.), reset the flag so the frontend doesn't stay stuck.
-          if (compacting) {
-            compacting = false;
-            log.warn('compaction flag reset on result — success signal was never received', {
-              clientId,
-            });
-            emit({ type: 'compaction_status', active: false });
-          }
-
           emit({
             type: 'token_update',
             agentContext: agentContextTokens,
@@ -967,14 +956,6 @@ async function _runQueryLoopInner(
                   blockType: 'text',
                 }),
               );
-            } else if (blockType === 'compaction') {
-              // SDK is compacting context — signal the frontend immediately.
-              // No snapshot block is pushed; the generic blockIdByIndex registration
-              // above is harmless — content_block_stop finds no snapshot block and
-              // silently skips, while openBlockCount stays balanced (++ here, -- there).
-              compacting = true;
-              log.info('compaction started', { clientId });
-              emit({ type: 'compaction_status', active: true });
             }
           } else if (evt?.type === 'content_block_delta') {
             const parentToolUseId = msg.parent_tool_use_id as string | undefined;
@@ -1052,7 +1033,6 @@ async function _runQueryLoopInner(
               const entry = toolInputBuffers.get(index);
               if (entry) entry.inputBuf += delta.partial_json as string;
             }
-            // compaction_delta — intentionally ignored (SDK-internal summary content)
           } else if (evt?.type === 'content_block_stop') {
             const parentToolUseId = msg.parent_tool_use_id as string | undefined;
             const subagent = parentToolUseId ? activeSubagents.get(parentToolUseId) : undefined;
@@ -1228,9 +1208,7 @@ async function _runQueryLoopInner(
           const compactResult = (msg as Record<string, unknown>).compact_result;
           if (subtype === 'status' && compactResult === 'success') {
             numCompactions++;
-            compacting = false;
             log.info('compaction completed', { clientId, numCompactions });
-            emit({ type: 'compaction_status', active: false });
           }
 
           // Track subagent task lifecycle for interrupt cancellation
diff --git a/server/task-orchestrator.ts b/server/task-orchestrator.ts
index aa5d68f7..d792f977 100644
--- a/server/task-orchestrator.ts
+++ b/server/task-orchestrator.ts
@@ -14,6 +14,7 @@ export interface LoopStatus {
   progress: { done: number; total: number } | null;
   specMode: boolean;
   awaitingApproval: boolean;
+  spawnEnabled: boolean;
 }
 
 export interface StartOptions {
@@ -42,8 +43,21 @@ export interface OrchestratorDeps {
 }
 
 export class TaskOrchestrator {
-  /** Maximum concurrent spawn dispatches per tick chain to prevent runaway loops. */
-  private static readonly MAX_SPAWN_DEPTH = 50;
+  /**
+   * Per-tick-chain ceiling: max spawns before deferring to next tick.
+   * SPAWN_RATE_LIMIT is the cross-chain ceiling (per window).
+   * Both must be >= 1.
+   */
+  private static readonly MAX_SPAWN_DEPTH = 5;
+
+  /** Grace period (ms) before orphan detection can reclaim a recently-spawned task. */
+  private static readonly SPAWN_GRACE_MS = 60_000;
+
+  /** Cross-chain ceiling: max spawns within SPAWN_RATE_WINDOW_MS. Must be >= 1. */
+  private static readonly SPAWN_RATE_LIMIT = 5;
+
+  /** Rate limit window (ms). */
+  private static readonly SPAWN_RATE_WINDOW_MS = 60_000;
 
   private state: LoopState = 'idle';
   private goalId: string | null = null;
@@ -52,8 +66,18 @@ export class TaskOrchestrator {
   private awaitingApproval = false;
   private pinnedClientId: string | null = null;
   private spawnDepth = 0;
+  private _spawnEnabled = false;
   private deps: OrchestratorDeps;
 
+  /** Tracks recently-spawned task IDs with their spawn timestamp for orphan detection grace. */
+  private recentSpawns = new Map<string, number>();
+
+  /** Sliding window of spawn timestamps for global rate limiting. */
+  private spawnTimestamps: number[] = [];
+
+  /** Timer for retrying after rate limit, so rate-limited tasks don't stall. */
+  private rateLimitRetryTimer: ReturnType<typeof setTimeout> | null = null;
+
   constructor(deps: OrchestratorDeps) {
     this.deps = deps;
   }
@@ -62,6 +86,16 @@ export class TaskOrchestrator {
     return this.pinnedClientId;
   }
 
+  get spawnEnabled(): boolean {
+    return this._spawnEnabled;
+  }
+
+  setSpawnEnabled(enabled: boolean): void {
+    this._spawnEnabled = enabled;
+    log.info('spawn enabled changed', { enabled });
+    this.deps.broadcastStatus(this.getStatus());
+  }
+
   getStatus(): LoopStatus {
     const progress = this.goalId ? this.computeProgress(this.goalId) : null;
     return {
@@ -71,6 +105,7 @@ export class TaskOrchestrator {
       progress,
       specMode: this.specMode,
       awaitingApproval: this.awaitingApproval,
+      spawnEnabled: this._spawnEnabled,
     };
   }
 
@@ -93,6 +128,15 @@ export class TaskOrchestrator {
     this.awaitingApproval = false;
     this.pinnedClientId = this.deps.getClientId();
 
+    // Clear spawn tracking state so a new goal isn't rate-limited by the previous one
+    this.recentSpawns.clear();
+    this.spawnTimestamps = [];
+    this.spawnDepth = 0;
+    if (this.rateLimitRetryTimer) {
+      clearTimeout(this.rateLimitRetryTimer);
+      this.rateLimitRetryTimer = null;
+    }
+
     log.info('orchestrator started', {
       goalId,
       title: goal.title,
@@ -148,6 +192,12 @@ export class TaskOrchestrator {
     this.awaitingApproval = false;
     this.pinnedClientId = null;
     this.spawnDepth = 0;
+    this.recentSpawns.clear();
+    this.spawnTimestamps = [];
+    if (this.rateLimitRetryTimer) {
+      clearTimeout(this.rateLimitRetryTimer);
+      this.rateLimitRetryTimer = null;
+    }
     this.deps.clearTaskContext();
     log.info('orchestrator stopped');
     this.deps.broadcastStatus(this.getStatus());
@@ -259,12 +309,30 @@ export class TaskOrchestrator {
   tick(): void {
     if (this.state !== 'running' || !this.goalId) return;
 
-    // Reclaim orphaned tasks
+    // Reclaim orphaned tasks (with grace period for recently-spawned tasks)
     if (this.deps.getActiveSessionIds) {
       const activeIds = this.deps.getActiveSessionIds();
       const orphans = this.deps.store.getOrphaned(activeIds);
+      const now = Date.now();
+
+      // Prune expired grace entries to prevent unbounded growth
+      for (const [taskId, spawnedAt] of this.recentSpawns) {
+        if (now - spawnedAt >= TaskOrchestrator.SPAWN_GRACE_MS) {
+          this.recentSpawns.delete(taskId);
+        }
+      }
+
       for (const orphan of orphans) {
+        const spawnedAt = this.recentSpawns.get(orphan.id);
+        if (spawnedAt && now - spawnedAt < TaskOrchestrator.SPAWN_GRACE_MS) {
+          log.info('skipping recently-spawned task in orphan detection', {
+            taskId: orphan.id,
+            ageMs: now - spawnedAt,
+          });
+          continue;
+        }
         log.info('reclaiming orphaned task', { taskId: orphan.id });
+        this.recentSpawns.delete(orphan.id);
         this.deps.store.update(orphan.id, { status: 'pending' });
         this.deps.store.setSessionId(orphan.id, null);
       }
@@ -343,9 +411,47 @@ export class TaskOrchestrator {
       case 'agent_work':
       default: {
         // Default to spawn so tasks get dedicated sessions unless explicitly 'reuse'.
-        const policy = next.sessionPolicy === 'reuse' ? 'reuse' : 'spawn';
+        // When spawning is disabled (kill switch), force all tasks to reuse the pinned session.
+        const policy = next.sessionPolicy === 'reuse' || !this._spawnEnabled ? 'reuse' : 'spawn';
 
         if (policy === 'spawn' && this.deps.spawnSession) {
+          // Global rate limit: refuse to spawn if too many recent spawns
+          const now = Date.now();
+          this.spawnTimestamps = this.spawnTimestamps.filter(
+            (t) => now - t < TaskOrchestrator.SPAWN_RATE_WINDOW_MS,
+          );
+          if (
+            TaskOrchestrator.SPAWN_RATE_LIMIT > 0 &&
+            this.spawnTimestamps.length >= TaskOrchestrator.SPAWN_RATE_LIMIT
+          ) {
+            log.warn('spawn rate limit reached, deferring task', {
+              taskId: next.id,
+              spawnsInWindow: this.spawnTimestamps.length,
+            });
+            // Schedule a retry after the oldest entry expires so tasks don't stall.
+            // Invariant: spawnTimestamps is non-empty here (length >= SPAWN_RATE_LIMIT >= 1).
+            if (!this.rateLimitRetryTimer) {
+              const oldestAge = now - this.spawnTimestamps[0];
+              const msUntilOldestExpires = Math.max(
+                100,
+                TaskOrchestrator.SPAWN_RATE_WINDOW_MS - oldestAge + 100,
+              );
+              this.rateLimitRetryTimer = setTimeout(() => {
+                this.rateLimitRetryTimer = null;
+                if (this.state === 'running') {
+                  log.info('rate limit retry timer fired, re-ticking');
+                  this.spawnDepth = 0;
+                  this.tick();
+                }
+              }, msUntilOldestExpires);
+            }
+            break;
+          }
+
+          // Record spawn for rate limiting and orphan detection grace
+          this.spawnTimestamps.push(now);
+          this.recentSpawns.set(next.id, now);
+
           // Spawn a dedicated headless session for this task
           this.deps.store.update(next.id, { status: 'active' });
           this.deps.store.cascadeStatus(next.id);