Start Building

Lesson 94: Escalation Send Kill-Switch - Hold External Messaging When Lesson 90 Ingestion or Governance Hashes Drift After a Lesson 92 Pass

Direct answer: An escalation send kill-switch is the automated hold on every Lesson 93 external_message_id when ground truth moves after the Lesson 92 dry_run_verdict hit pass but before the operator clicks send or the CMS publishes. It compares frozen hashes from the dry-run row against live Lesson 90 ingestion snapshots and governance deck pointers.

Fish illustration suggesting a small predator that snaps the line when bait drifts after you already called the rehearsal good

What this lesson solves

Dry-run passes are timestamped opinions. Support merges, finance edits, or a late governance PDF swap can change the facts your Lesson 91 rollup row was rehearsed against. This lesson stops optimistic sends that cite a stale verdict.

Prerequisites: Lesson 92 row with dry_run_verdict = pass, Lesson 93 rows for each channel bundle, and Lesson 90 drift log reachable for the same train_cycle_id. Expected time: about eighty minutes including a tabletop on a marketing lead bypass attempt.

What you will build

  1. lesson78_escalation_send_kill_switch_policy.md (contract below)
  2. lesson78_escalation_send_kill_switch_log.csv (one row per hold or release decision)
  3. A three-hash compare job wired to your CMS or mail-merge tool (manual checklist acceptable for indies)

Step 1 - Define kill-switch gate classes

gate trip signal default posture
K1 – Ingestion drift lesson78_first_week_intervention_governance_drift_log.csv drift_evidence_hash or appended rows changed after dry_run_evidence_hash freeze hold all external bundles for that train_cycle_id
K2 – Governance deck drift governance_deck_version or bullet id set differs from values copied into Lesson 92 footer hold
K3 – Rollup lineage drift rollup_packet_id_ref still exists but its rollup_evidence_hash (Lesson 91) changed hold
K4 – Message body drift signed_message_body_hash in Lesson 93 differs from the artifact loaded in the send tool hold and alert

Step 2 - Author lesson78_escalation_send_kill_switch_policy.md

Minimum sections:

  1. Purpose – prevent post-pass drift sends that would make the Lesson 92 verdict a decorative footnote.
  2. Freeze markers – record freeze_at_utc when dry-run hits pass; all compares use rows at or before freeze unless policy allows a signed supersede ticket.
  3. Hash inputs – explicit ordered tuples for sha256: ingestion snapshot ids, governance deck version string, rollup packet hash, Lesson 93 signed body hash.
  4. Automation vs human – if automation is absent, require two-person read of K1–K4 within fifteen minutes of publish intent.
  5. Release criteria – either drift resolves back to frozen hashes, or you open a new Lesson 92 dry-run row and Lesson 93 bundle rows with fresh hashes.
  6. Audit – store hold/release rows with operator ids; no silent overrides.

Step 3 - Author lesson78_escalation_send_kill_switch_log.csv

column purpose
kill_switch_event_id stable id
train_cycle_id ties Lessons 89–93
dry_run_id_ref Lesson 92 row that was pass
external_message_id_ref Lesson 93 bundle
freeze_reference_hash sha256 over the tuple frozen at dry-run pass
live_reference_hash sha256 over current inputs at publish intent
trip_gate K1 / K2 / K3 / K4 / none
send_state held / released_after_refresh / aborted
operator_pair two ids for manual mode
kill_switch_evidence_hash sha256 over prior columns + timestamps

Step 4 - Wire the publish click (35 minutes)

  1. Export freeze tuple from Lesson 92 row: copy dry_run_evidence_hash, cited rollup_packet_id_ref, governance deck version, and Lesson 90 drift hash fields referenced in the deck footer.
  2. Poll live sources right before send: re-query Lesson 90 append-only log tail, governance CMS version, Lesson 91 row hash.
  3. Compare to freeze tuple; any delta trips K1–K3.
  4. Load canonical Lesson 93 body from your vault (not from email draft) and hash to guard K4.
  5. If hold, block the API key or toggle CMS state to draft; write the kill_switch_log row before telling stakeholders.

Step 5 - Tabletop - marketing “it is just a wording tweak”

A PM edits the status blog HTML in the CMS without changing the Lesson 93 row. Outcome: K4 trip; hold triggers even though ingestion is stable—because the signed body no longer matches rehearsal.

Pro tips

  • Freeze tuple in CI – store the freeze tuple as a build artifact beside your release branch so support tools cannot “hot fix” copy without tripping K4.
  • Narrow blast radius – if only one region’s ingestion moved, hold region-scoped bundles first instead of global silence.
  • Clock discipline – use the same UTC source for freeze_at_utc and publish timers; daylight-saving bugs masquerade as drift.

Troubleshooting

symptom likely cause fix
Kill-switch trips every send freeze tuple captured before Lesson 92 deck export finalized re-record freeze after deck PDF hash stabilizes
Hold never trips when facts change comparing headline deck only, not Lesson 90 totals add K1 ingestion tail diff
Operators override in the mail tool send path bypasses CMS route external sends only through gated pipeline

Common mistakes

  • Treating K1 as “warning” – default posture is hold, not email-the-manager.
  • Re-running Lesson 92 without new Lesson 93 rows and wondering why K4 still fails.
  • Using chat attachments as the publish body instead of the hashed vault artifact.

FAQ

Does a kill-switch replace Lesson 85 bridge?

No. Lesson 85 handles live contradictions. This gate handles scheduled sends after rehearsal.

Can we ship if only governance deck drifted but numbers look fine?

Not under K2. Narrative scope changed; rehearse again or refresh the deck hash deliberately with sign-off.

What if the hold blocks a contractual partner window?

Log send_state=aborted, open a supersede ticket, and run a fresh dry-run; do not “temporarily” lift the hold without new hashes.

Lesson recap

A pass in the war room is not a license to ship while the factory floor keeps moving. The kill-switch is the safety interlock between rehearsal truth and player inboxes.

Next lesson teaser

Next: Lesson 95: Signed Operator Override Ledger covers dual-signature, channel-allowlisted sends during an active hold, with mandatory rollback rows and hashed override evidence.

Related learning

Treat the send button as industrial equipment, not a send tweet toy.