fix: bound task failures and release stalled workers

tests/unit/admin_console/test_model_settings.py

@@ -33,6 +33,12 @@ def isolated_settings(monkeypatch, tmp_path):
         "ARTEMIS_OUTPUTTER_ENABLED",
         "ARTEMIS_STEP_SUMMARIZER_ENABLED",
         "ARTEMIS_SCREENSHOT_LIMIT_ENABLED",
+        "ARTEMIS_TASK_TIMEOUT_SECONDS",
+        "ARTEMIS_OBSERVATION_TIMEOUT_SECONDS",
+        "ARTEMIS_OBSERVATION_MAX_ATTEMPTS",
+        "ARTEMIS_DEVICE_COMMAND_TIMEOUT_SECONDS",
+        "ARTEMIS_ACTION_FAILURE_ATTEMPTS",
+        "ARTEMIS_WORKER_CLEANUP_TIMEOUT_SECONDS",
     ]
     for key in keys:
         monkeypatch.setattr(settings, key, getattr(settings, key))
@@ -202,3 +208,26 @@ def test_responses_payload_has_reasoning_and_no_sdk_retry(monkeypatch, effort):
     assert factory.call_args.kwargs["use_responses_api"] is True
     ModelFactory.create_model(ModelEndpoint(api_key="test-only", reasoning_effort="default"))
     assert "reasoning_effort" not in factory.call_args.kwargs
+
+
+def test_execution_protection_saves_reload_without_touching_secret(isolated_settings):
+    result = service.save_capability_settings(
+        service.CapabilitySettings(
+            task_timeout_seconds=3600,
+            observation_timeout_seconds=45,
+            observation_max_attempts=2,
+            device_command_timeout_seconds=8,
+            action_failure_attempts=4,
+            worker_cleanup_timeout_seconds=15,
+        )
+    )
+    reloaded = Settings(_env_file=isolated_settings)
+    assert reloaded.ARTEMIS_TASK_TIMEOUT_SECONDS == result.task_timeout_seconds == 3600
+    assert reloaded.ARTEMIS_OBSERVATION_TIMEOUT_SECONDS == 45
+    assert reloaded.ARTEMIS_OBSERVATION_MAX_ATTEMPTS == 2
+    assert reloaded.ARTEMIS_DEVICE_COMMAND_TIMEOUT_SECONDS == 8
+    assert reloaded.ARTEMIS_ACTION_FAILURE_ATTEMPTS == 4
+    assert reloaded.ARTEMIS_WORKER_CLEANUP_TIMEOUT_SECONDS == 15
+    assert reloaded.OPENAI_API_KEY is None
+    assert settings.OPENAI_API_KEY.get_secret_value() == "existing-test-secret"
+    assert dotenv_values(isolated_settings)["UNRELATED"] == "keep"