Stop / start / recreate / destroy semantics

Command	What happens	Volume
agent stop <name>	EC2 StopInstances; heartbeat stops, status → stopped	kept (attached, not billed for compute)
agent start <name>	EC2 StartInstances on the existing instance; public IP changes (not an Elastic IP — nothing depends on it, Tailscale’s address is what matters)	kept
agent recreate <name> --yes	Terminates the instance, keeps the volume, re-runs the create sequence against the same volume — a from-scratch box, same data. Clears the row’s bootstrap and command (a fresh bootstrap, not a resumed one) and sets hermeticd_version from the fleet manifest’s current pointer	kept, reattached
agent destroy <name> --yes [--keep-volume]	Terminates the instance, deletes its tailnet devices, SSM parameters and S3 config, deletes the data volume, waits for the instance to reach terminated, then releases the name: a tombstone is written and the agent row is deleted. Events are never deleted. The name is reusable at once, and a create of it is a brand-new agent.	deleted by default — pass --keep-volume to keep it. A kept volume is released from the name (agent=<name> becomes hermetic:former_agent=<name>), so a later create of the same name starts on a fresh disk; hand the old one over on purpose with agent create <name> --volume vol-…

recreate and destroy both refuse without --yes (CONFIRMATION_REQUIRED) and both go through plan.recreate/plan.destroy first if you want to see the steps before committing — hermetic plan prints what a destructive command would do without doing it. plan destroy takes the same --keep-volume, and its volume step reads delete or keep accordingly.

Destroy waits for the instance to be terminated before it releases the name, and the wait has no time limit; a slow EC2 termination shows as the instance phase sitting there, with the agent’s lock renewed, and finishes when EC2 does. A destroy that died partway is finished by running it again.

Reviewing destroyed agents

A destroyed agent has no row, so it is absent from agent ps and the dashboard’s Agents lens. hermetic agent destroyed [name] [--limit <n>] [--json] lists what was destroyed, newest first: when, by whom, how long it lived, and whether its volume was kept or deleted (with the id). The dashboard’s Destroyed lens, beside Agents and Volumes, shows the same table; a row opens a read-only panel with that incarnation’s history. When a name has been reused, hermetic agent history <name> shows every incarnation back to back — pass a tombstone’s created_at and destroyed_at (agent destroyed <name> --json) as --since/--until to read one life alone. Agents destroyed before tombstones existed appear as legacy entries; running agent destroy <name> (or agent create <name>) on one releases it, and its volume, if it still names one, is kept and released from the name, never deleted. A kept volume shows in hermetic volume ls under no_agent, retained by the former agent’s name.