fix(kernel): survive restarts — don't kill live agents, don't rename hand instances

[Nideesh1]

Two restart/liveness bugs found while running a collector agent in production. Both destroy work silently.

---

1. Agents declared dead while waiting on the model

An AutonomousConfig could make the liveness bound tighter than the default, and did so for every agent using the default 30s heartbeat interval:

heartbeat_interval_secs = 30   (agent.rs, default)
UNRESPONSIVE_MULTIPLIER = 2
→ 60s liveness window

HeartbeatConfig::default_timeout_secs = 180
DEFAULT_AGENT_TURN_TIMEOUT_SECS       = 600

A turn is allowed 600 seconds; the agent was declared dead after 60. Observed live, flapping on an exact 60-second cycle:

05:37:48 Unresponsive Running agent marked as Crashed  inactive_secs=89
05:38:18 Auto-recovering crashed agent (attempt 1/3)
05:38:48 Agent recovered successfully
05:39:48 Unresponsive Running agent marked as Crashed  inactive_secs=89
05:40:48 Agent recovered successfully
05:41:48 Unresponsive Running agent marked as Crashed  inactive_secs=77

Each "recovery" restarts the loop and discards the in-flight turn, so any sweep whose model call exceeds 60s could never finish. Waiting on the model is not being hung. Likely cause of previously-seen sweeps that burned their whole iteration budget and delivered nothing, and of scheduled jobs hitting their turn timeout.

Fix. The per-agent value now only ever raises the bound (max() against the default) — a heartbeat interval describes how often an agent checks in, not how long a turn may take. The default moves 180 → 600 to match DEFAULT_AGENT_TURN_TIMEOUT_SECS; an agent inside its turn budget is by definition not dead, and the turn timeout remains what ends an over-running turn.

Trade-off: a genuinely hung agent now takes up to 10 minutes to detect instead of 1. That is the right side to err on — the current behaviour destroys live work every 60 seconds, while a hung agent is still caught, just later, with auto-recovery unchanged.

2. Named hand instances lose their name on restart

persist_state never wrote instance_name, load_state never returned it, and the restore path passed None:

match self.activate_hand(&hand_id, config, None) {

The name decides the agent id (hand_instance_<instance_id> vs the legacy id derived from hand_id), the agent name, and therefore the workspace directory. A collector activated as underground came back after a deploy as collector-hand, under a different agent id, in a different workspace — orphaning its context.md and accumulated output. The original agent survived as a stray with no hand registration, so the box ended up running two collectors against one knowledge graph, both delivering reports.

It also defeated the cron reassignment immediately below it: jobs were migrated onto the wrong agent, so a tuned schedule (cadence, timeout) silently reverted to hand defaults on every restart. Observed exactly that — a 3-hourly/2400s schedule reverted to 6-hourly with no timeout, and then failed with error: timed out after 600s.

Fix. Persist the name, return it, restore under it. Read with .get() so state written before the field existed still loads, as unnamed — matching today's behaviour for those entries.

---

Tests

• test_autonomous_config_never_shortens_timeout — the default 30s interval no longer drags the bound below the default; a generous interval still raises it.
• test_instance_name_survives_persist_reload — a named instance comes back named.
• test_load_state_without_instance_name_is_unnamed — legacy state still loads.

test_active_agent_detected_unresponsive had its timings calibrated to the old 180s bound (300s inactivity was "past timeout" then, but is inside 600s now), so it would have silently started asserting the wrong thing. It now derives them from DEFAULT_UNRESPONSIVE_TIMEOUT_SECS. test_heartbeat_config_default likewise asserts against the constant.

Simulated the threshold-sensitive cases against the new bound before submitting:

idle_agent_skipped            inactive=300s -> skipped (never active)  OK
active_detected_unresponsive  inactive=660s -> unresponsive            OK
active_within_timeout_ok      inactive= 10s -> responsive              OK

cargo fmt --all --check clean. Not compiled locally — this host is a cluster node and cargo OOM-killed kube-apiserver on it previously.

🤖 Generated with Claude Code