# Pause, resume, restart or stop safely

Choose a service-control action by its consequences, not by which status badge you want to clear. These commands change running work. You need operator permission for the exact controller-launched service and the CLI on PATH; a recorded agent request is not permission by itself.

## Review the target

Inspect `fleetctl show "SERVICE_ID"`, substituting the exact identity. Check owner, purpose, working directory, recorded command, PID/process group, lease and recent events. Preserve output or unsaved work before a disruptive action. Claimed and unmanaged processes are not eligible for these controller controls.

## Choose one action

| Intent | Command with the inspected identity | Consequence |
| --- | --- | --- |
| Suspend scheduling | `fleetctl pause "SERVICE_ID"` | Retains process group, memory and ports |
| Continue paused work | `fleetctl resume "SERVICE_ID"` | Work and expiry cleanup can resume |
| Start the recorded command again | `fleetctl restart "SERVICE_ID"` | Stops the old group, waits, then replays recorded argv |
| End the service | `fleetctl stop "SERVICE_ID"` | Requests SIGTERM, then escalation after the grace period |

Do not run the table as a sequence. A restart is appropriate only if the recorded command is still correct for the project. It is not a substitute for reviewing configuration changes. `kill` is immediate SIGKILL with no grace period and is not the normal stop path.

## Verify the action, then the task

Inspect the same record and its events after the action. On resume or restart, confirm a fresh health-check result if configured and separately check the task's useful result. On stop, do not treat an accepted request as proof all work disappeared. Escaped descendants or a surviving listener require their own current identity review.

If identity verification refuses an action, do not bypass it with a raw PID signal. Re-read current observations and consult the owner. The [CLI control reference](https://github.com/janestreetshiller/fleet-console/blob/87c38aff663db2e0c70e90eea5c8781ceb32a1e4/docs/CLI.md) describes verify-before-signal behavior.