The durable switch is <dataRoot>/control/processing.json, using the root resolved by the existing system configuration loader. All businesses in that root share one switch; separate roots remain independent. No package selects an instance by business name or systemd unit name.

A human runs mosaic halt [--business ID], mosaic processing status --json and mosaic resume [--business ID]. The business chooses the human proof context. Halt publishes state before waiting for stops. Resume checks the displayed generation and refuses while a stop is unresolved. Neither agents nor tester sessions can change the switch. CLI channel settings cannot disable recovery.

The bus remains available for reads and human management. Managed processing, new sessions, task containers, tracker activity and outbound notification stop. Native diagnostic/development seats remain available. A remote request already accepted cannot be undone: its completion or unknown outcome remains evidence. No task is automatically retried on resume.

The trusted host explicitly initializes the first off document. Once control/ exists, a missing, malformed, unsafe or oversized state refuses work. Recovery is halt, then resume; unsafe parent ownership/path boundaries require operator repair. Never delete the file to clear a halt. State publication uses exclusive temporary files, fsync and atomic rename. Run evidence remains write-once.

Runtime receipts bind generated ids to the canonical root, boot id and process start ticks or inspected container id and labels. Stops begin concurrently, TERM first, then KILL after five seconds, with two seconds for observation. Unknown remains unknown and prevents resume. Stop receipts are write-once and mirrored into reserved bus actions. An interrupted Docker CLI is not evidence that its container stopped; a container that cannot be inspected stays unknown.

Task containers mount the whole control directory read-only, below the existing root mount. The image entrypoint uses the shared strict reader and admission generation. A row-191 upgrade must stop old processing before the first trusted initialization and align the image, bus and copy in a separately approved window. Nothing in a code build performs that activation.

The Console status and persistent halted banner work read-only. The controls require the existing authenticated human write path and --send; during Q175's interim the UI explains that the instance CLI is the working path. No write exception or alternate authentication scheme is introduced.