harness: pause the submit queue so the next turn comes from the composer

[btipling]

Summary

After a turn error, the harness correctly stops and does not drain the queue (#756 / PR #774): lifecycle lands on Error, tryPromoteQueued does not pop, and a Continue the current turn row may sit at the head. The operator’s follow-ups stay parked.

The remaining gap: the operator has items in the queue, the turn has ended, and they want to continue the failed work from the composer (“continue”, a correction, a smaller retry) without the next send taking a queue item.

There is no way to pause the queue. Without a pause:

• Idle ▶ / Ctrl+Enter with an empty composer promotes the head (plan plan: harness — Stop/Esc never drains the queue; idle ▶ promotes when composer empty (#757) #760) — that is the Continue row or the next follow-up, not the typed continue.
• A typed composer send does start from the input, but a later successful Ready auto-promotes the head, so the parked follow-ups fire as soon as the continue turn succeeds.

Pause means: the next turn reads directly from the composer. The FIFO stays intact and does not promote until the operator unpauses.

Current baseline (live code / PR #774)

Claim	Path / symbol	Notes
Error never auto-promotes	bridge.shouldAutoPromote — terminal = cur == .ready	busy → err does not pop. Goal of #756.
Give-up inserts Continue at head	insertContinueTurnPrompt / inv_queued_insert_front	Only when queue non-empty and not full. Not auto-sent.
Stop never drains	plan #760 / setQueuePromoteAllowed(false)	Queue stays; explicit Play promotes.
Successful Ready auto-promotes	ui.zig + promote gate armed true	Head becomes a normal user turn.
Idle empty ▶ / empty Ctrl+Enter	composer_chrome.zig on_promote → tryPromoteQueued	Explicit Play of the head. Typed ▶ still on_send.
No pause latch	submit queue / composer	Nothing holds auto-promote + explicit Play while the operator types a continue.

Operator report: turn errored, queue still has work, “how do I continue the previous task without consuming the queue?”

Goals

#	Goal	Success signal
1	Operator can pause the submit queue (idle, including after Error / Stop)	Visible paused state; FIFO contents unchanged (no pop, no insert, no clear)
2	While paused, the next turn comes from the composer	Typed prompt + ▶ / Ctrl+Enter sends that text. Empty ▶ / empty Ctrl+Enter does not tryPromoteQueued
3	While paused, a successful Ready does not auto-promote	Continue-turn succeeds → Ready → queue depth unchanged; head still the same row
4	Operator can unpause; parked items drain by the existing rules	Unpause + successful Ready (or explicit empty ▶) promotes the head as today
5	Pause does not cancel an in-flight turn and does not retry	In-flight Busy / Stop / #756 retry path unchanged. Pause is a queue hold, not a turn control
6	Enqueue / edit / remove / Clear still work while paused	Follow-ups can still be parked or dropped; pause only blocks promote

Non-goals / out of scope

• Do not auto-send Continue the current turn (already a harness: turn errors must retry the current turn — never drain the queue #756 non-goal — park it; the operator types the continue)
• Do not change harness: turn errors must retry the current turn — never drain the queue #756 retry (5 attempts / give-up / Error / Continue-at-head)
• Do not change harness: Stop/Esc must not drain the queue; idle ▶ promotes when the composer is empty #757 / plan: harness — Stop/Esc never drains the queue; idle ▶ promotes when composer empty (#757) #760 Stop semantics (Stop still does not drain)
• Do not persist pause on the cloud session (same Wasm-ephemeral lifetime as the queue: refresh / New / Clear / session switch wipe it)
• Do not raise MAX_ITEMS / SUBMIT_CAP
• Forbidden wiring: dual DOM chat · secrets in Wasm · laptop-only Production ops

Design sketch

A single paused latch on the Wasm submit-queue (the FIFO already lives there). Host/composer send path is unchanged: typed text still queueSubmitFromUi / on_send.

While paused:

• shouldAutoPromote / tryPromoteQueued no-op (same shape as the edit-lock and the v19 promote gate).
• Idle empty ▶ and empty Ctrl+Enter no-op (do not Play the head).
• Typed send starts a normal turn from the composer.

Unpause clears the latch. The next successful Ready or explicit Play drains as today.

Chrome: an in-canvas pause/resume on the queue band (not a DOM control). Exact glyph/copy is plan-time.

Testing

#	Case	Layer	Expected
1	Error + non-empty queue + pause + type “continue” + send	harness	One new user line with that text; queue depth unchanged; head not consumed
2	Paused + empty idle ▶ / empty Ctrl+Enter	harness	No promote, no blank row
3	Paused continue-turn succeeds	harness	Ready; queue not auto-promoted
4	Unpause after (3)	harness	Next successful Ready or empty ▶ promotes the head (Continue or original follow-up)
5	Pause while Busy	harness	In-flight turn untouched; enqueue still appends; no promote until unpaused and a success/Play
6	Refresh / New / Clear / session switch	harness	Pause latch gone with the queue (Wasm-ephemeral)

Cloud ops

N/A — no Production mutate. Pause is in-canvas queue state.

Living docs

Surface	Change
docs/harness-limits.md Submit queue	Pause: next turn from composer; no auto-promote / no empty-▶ Play until unpaused
AGENTS.md	Only if a new cap/export lands
README / SECURITY / .env.example	N/A unless a protocol export is required

Refs #756 (error never drains; Continue-at-head) · #757 (Stop never drains; idle ▶ Play) · PR #774 · plan #759 / #760

[btipling]

Closed: shipped in PR #778 — operator-initiated Pause latch on the Wasm submit queue (in-canvas header toggle, auto-clear on empty FIFO), protocol stays v20, no new export, cap-agnostic.