docs(cloud-agent-next): scope agent_unresponsive to the right restarts

The activity-capacity carve-out and the dead-event-stream path were
described with the wrong reason in the spec and the control-plane doc.

Author: eshurakov

.specs/cloud-agent-session.md

@@ -119,7 +119,8 @@ repository.
    A Kilo that stops answering while the sandbox reclaims at its memory cap
    MUST be held instead of restarted, for at most ten minutes; the hold MUST
    pause the no-progress clock and post a non-fatal notice. A turn failed by a
-   hang restart MUST say that Kilo was not responding.
+   hang restart MUST say that Kilo was not responding, unless the restart was
+   for exhausted activity-tracking capacity while Kilo still answered.
    The separate 120-minute execution cap MUST include user waits. Native
    cancellation MUST be bounded and confirmed; unconfirmed cancellation MUST
    use bounded runtime recovery. Accepted Cloud messages MUST settle once;

services/cloud-agent-next/docs/control-plane.md

@@ -625,7 +625,8 @@ native activity plus the existing Cloud-work and PTY protections.
   again, once. Its prompts go back to the front of the inbox in order, with the same `messageID`s
   (Kilo stores messages by ID). No real progress means no tool events, so no tool work repeats. A
   turn with real progress, or one already submitted again, gets `failed`: `agent_unresponsive`
-  after a hang restart (including one at the end of a memory hold), otherwise `agent_restarted`.
+  after a hang restart (including one at the end of a memory hold) other than one for exhausted
+  activity capacity, otherwise `agent_restarted`.
 - That recovery selection occurs only in the restart-completion turn transition. It invalidates
   the retired submission chain and rebuilds the existing inbox in original message order, without
   waiting for held retired HTTP results. Restart-caused transport rejection is recognized by the
@@ -722,7 +723,8 @@ them through one development-only override.
 | Socket down 90 s | Sandbox DO | Stop the sandbox | Accepted fail (`connection_lost`); queued re-prepare |
 | Wrapper crash | Supervisor | Restart wrapper; routes re-prepared | Accepted fail (`agent_restarted`) |
 | Kilo hang (no events, no HTTP answer) | Wrapper, about 35 s; up to 10 min while the workload reclaims at its memory cap | Restart Kilo, at most 3 in 10 min | Busy turn without real progress: submitted again once; otherwise accepted fail (`agent_unresponsive`) |
-| Kilo crash or dead event stream | Wrapper | Restart Kilo, at most 3 in 10 min | Same as Kilo hang, but the reason is `agent_restarted` |
+| Kilo crash | Wrapper | Restart Kilo, at most 3 in 10 min | Same as Kilo hang, but the reason is `agent_restarted` |
+| Dead event stream (Kilo still answers health) | Wrapper, after 6 reconnects in 2 min | Restart Kilo, at most 3 in 10 min | Same as Kilo hang (`agent_unresponsive`) |
 | Kilo restart budget used up | Wrapper | None until the next message | Queued and accepted fail (`agent_unavailable`) |
 | Kilo final error | Wrapper | None (Kilo already retried) | Accepted fail with Kilo's reason |
 | No real progress for 20 min, including silent tools | Native session supervisor | Bounded tree abort; runtime recovery if unconfirmed | Accepted fail (`no_progress`), or routed error without a current turn |