Standdowns

Why the switch had to exist

Before this row, the honest answers to "stop, now, everything" were toggling enabled on Routines one at a time — which stops no Wakeup, no Trigger, no mail automation, no sequence tick, and nobody who is chatting with the employee right now — or deleting the employee. Neither is a stop. A control that a colleague can accidentally route around by opening a chat window is not one either, which is why the two wider scopes cover interactive chat and the narrow one does not.

The three scopes, exactly

Wider scopes subsume narrower ones. What each covers is worth reading precisely, because the difference between them is the difference between an incident contained and an incident that kept going somewhere you weren't looking.

Company

Everything. Every Routine, every automatic retry, every Wakeup and Trigger, and interactive chat with every AI Employee in the company. Humans keep using the app in full; the roster stops working.

Employee

One employee, chat included. That employee's Routines, retries, Wakeups, Triggers, and any conversation someone opens with it. Its colleagues carry on untouched.

Routine

One Routine's scheduled and triggered Runs — including its queued retries and a manual "Run now". It does not stop chat with the employee that owns it: this is the surgical scope, for one broken piece of work, not for an employee you have stopped trusting.

What happens to work already moving

• In-flight Runs are aborted. A covered Run stops where it is and finalizes interrupted — the status that already means "nobody can say what happened after this line". It is not marked failed, because nothing failed; the work was stopped.
• Queued retries are deferred, not cancelled. A Run with a retry pending keeps its due time. The dispatcher declines to start it while the Standdown is active, and it fires after the lift. Standing a Routine down does not silently throw away the recovery attempt you may still want.
• Skipped scheduled slots still advance the schedule. A slot that arrives during a Standdown is declined and the next occurrence is computed as usual, so lifting a month-old Standdown produces no catch-up storm — the same ceiling downtime recovery keeps, for the same reason.
• Everyone covered is told. The reason lands on a banner, in the bell for owners and admins, and in the Journal of every covered employee — so the employee's own next prompt knows why the last few hours are missing.

The circuit breaker

A Routine can also stand itself down without anyone pressing anything. Genosyn counts consecutive bad Runs on each Routine — any terminal Run that is not completed, plus a completed Run whose required Checks failed or whose outcome graded off goal. The first Run that is clean on every axis resets the counter to zero.

On crossing the threshold, the runner places a Standdown on that Routine, recorded with source breaker rather than a person. The threshold is at Admin → Runtime, under Containment, and defaults to 5. Setting it to 0 disables the breaker entirely and restores the old behaviour: a permanently broken Routine firing every slot forever, burning model spend nobody is reading.

Admin-only, in both directions

Placing a Standdown and lifting one are both owner/admin. Placing requires a reason: a stop nobody explained is a stop nobody can safely lift. Lifting takes an optional note, and the row stays as history — lifted Standdowns enforce nothing and are never deleted, so "when did we stop the roster, and why" stays answerable afterwards.

It is not the enabled switch

Routine.enabled remains exactly what it was: the ordinary, per-Routine on/off for work you are done with, editing, or seasonally retiring. It is untouched by Standdowns and unchanged by lifting one. A Routine disabled before a Standdown is still disabled after it.

Use the switch for housekeeping. Use a Standdown for an incident — it is the emergency instrument, it records who and why, it covers the surfaces the switch cannot reach, and it is designed to be lifted rather than to be lived with.