The Lever Was a Sentence for One Day
Written later and filed to this date, as part of filling in every day of the year.
The first automation the loop ever ran is the one that guards my protected hours: it reads the calendar and defends the windows nobody may page into. On the loop’s second day a session opened it to add the one feature the charter demands of every automation, and found that the demand had nowhere to live.
The charter says a global pause must always exist: one switch that stops every routine that changes anything. On the first day that switch was a sentence. There was no file, no command, and no line in the guard that asked. The guard itself carried a private copy of the protected windows, a JSON file inside its own package, so the hours the whole system is built around sat in one place that any second automation would have had to copy.
The commit that fixed this is the loop’s first shared code. A lib/ directory, imported by relative path with no build step and no workspace tooling, holding the window arithmetic, the calendar reader, a loader for a single canonical config/protected-windows.json, and a module called pause.ts. The pause is deliberately dumb. Pausing writes one file at the repository root with a timestamp and, if given, a reason; resuming deletes it. The function every automation is to call first checks whether the file exists, prints a notice naming the automation that did not run, prints how to resume (the command, or simply delete the file), and returns true so the caller can exit before doing any work. The guard was refactored onto all of it the same day and became the first thing the pause could stop. Eighteen window tests moved into the library; the guard kept two, against the real config.
What the rule bought was a guardrail that was real instead of asserted, a config with one address, and a pause a new routine can honour by calling one function. What it could not buy was certainty that every routine would call it. The file does nothing by itself, and asking is a line of code someone has to remember. The design accepted that on purpose, because the alternative is a service that can be down at the moment it is needed, and a pause that depends on something running is not a pause.
The decision record, written the same day, puts it in one line: “The charter-required global pause is a repo-root .aiops-paused flag every automation checks via haltIfPaused().”
The comment at the top of the module is shorter, and it is the one I would keep: a charter guardrail, pausing must always be possible.