Fleet-wide work-stoppage / pause protocol — a universal "pending pause" sidecar on flower tool responses (coordinate Solo restart / update / laptop reboot / deploy across all daemons + agents + projects)

Operator-requested (Mike, 2026-07-05), motivated directly by THIS session's manual Solo-restart coordination. ## Problem Sometimes we need a coordinated, fleet-wide WORK STOPPAGE across every active Solo/flower daemon AND ephemeral agent (dispatched workers), often across MULTIPLE projects (flower + lounge + …), triggered by an EXTERNAL event: restart Solo, update Solo, restart the laptop, a deploy, etc. There's no primitive for it today. What I did BY HAND this session: operator told me → I snapshotted every session (session_id/proc/branch/brief from the roster + `~/.flower/agent-session-map.jsonl`) → messaged each worker to commit WIP + hold → aggregated "all committed" → green-lit the restart → wrote a backup snapshot (scratchpad 1099) for resume. It worked, but was fully manual, orchestrator-scoped (never reached lounge or any agent I wasn't actively driving), and leaned on Solo pokes — which may be unreliable (the Solo timer-response bug is what triggered this). ## The idea (operator's): a universal pause sidecar on flower tool responses flower's MCP is the ONE bus every agent (Claude/Codex/Pi, every project) already calls into. So piggyback the pause on flower tool RESPONSES: when a pause is active, EVERY flower tool call gets an appended alert/sidecar — "⚠️ PENDING WORK-STOPPAGE (<reason>): commit your WIP, record resume state, ack, and HOLD. Instructions: <…>". Reaches every active agent at near-zero latency, no per-agent poking, cross-project + cross-harness, and robust to the timer bug (it rides real tool traffic, not timers). ## Proposed shape - **`pause_requests` store:** reason (restart_solo | update_solo | restart_laptop | deploy | custom), scope (global | project), instructions, requested_by, status (active | clearing | cleared), created_at/cleared_at. - **MCP tools:** `pause_request(reason, scope, instructions)` (raise); `pause_ack(pause_id, actor_ref, resume_state{session_id, branch, brief, committed_head, notes})` (agent acks it's committed + safe, recording its own resume backup); `pause_clear(pause_id)` (lift → resume); read `recall_pauses`. - **Universal sidecar injection:** wrap the flower MCP tool-response path so, when a pause is active AND the caller hasn't acked, it appends the pause banner + instructions. After ack, drop to a compact "still paused — hold" reminder (anti-spam). On clear, one "▶️ RESUME — pause lifted" sidecar. Make it a hard tool-result field agents can't miss (not just prose an auto-mode agent might skim past). - **Readiness rollup:** track acks → "N/M agents paused & safe" view for the operator green-light (mirrors the reset/winddown readiness pattern). Grace-window MIA flag for agents that haven't acked (so the operator knows who's not yet safe — e.g. an agent mid-long-turn like #229's sub-agent this session). - **Auto-backup:** on `pause_request`, auto-generate the fleet snapshot (every live session's session_id/proc/project/branch/brief from roster + agent-session-map) — automate what I hand-built as scratchpad 1099. - **Resume:** `pause_clear` lifts; agents continue via the resume sidecar; daemons re-checkin + re-arm timers if the pause coincided with a process restart. ## How it differs from existing flows - **Daemon reset/winddown** is SELF-driven, per-daemon, internal (context limits). This is EXTERNALLY-triggered, FLEET-WIDE (all daemons + ephemeral workers), cross-project. - **Coordination queue / signals (#245)** is orchestrator-drained + daemon-targeted; it does NOT reach ephemeral workers (who don't drain signals). Hence the tool-response sidecar, not a signal. ## Open questions - Sidecar noise: inject-until-acked then compact reminder; per-response vs per-tool. - Who can raise/clear (operator always; which daemon roles?). - Cross-project: a global pause reaches lounge agents via the shared flower MCP sidecar — confirm lounge daemons honor it. - Ephemeral-worker ack + identity for the readiness rollup (dispatch_request / session_id). - Failsafe/timeout + "can't ack mid-long-turn" handling. - Auto-mode agents reliably surfacing/acting on the sidecar. ## Provenance / refs 2026-07-05 manual Solo-restart coordination (Solo timer bug). Artifacts: fleet snapshot scratchpad 1099, per-worker WIP commits (#217 5505e8b / #244 066ded0 / #229 63e0e2f). Refs: #245 (coordination-drain resilience), #226 (daemon lifecycle: reset/winddown/park), fb#123, fb#127.