Blast radius containment — pause affected campaigns only

When a campaign starts generating complaint spikes, the correct response is to pause that campaign — not halt the entire email system. A queue worker that can only be stopped globally means that pausing one broken campaign takes down order confirmations, password resets, and MFA codes simultaneously. NIST SP 800-53 IR-4 (Incident Handling) requires that incident containment minimizes collateral impact. The Campaign Orchestration & Sequencing Audit verifies sequence management; this check verifies that the pause mechanism is fine-grained enough to contain an incident without collateral damage.

Add a campaign status check at the start of each job in the queue worker, before any send logic runs:

async function processEmailJob(job: Job) {
  const campaign = await db.campaign.findUnique({ where: { id: job.data.campaignId } })
  if (campaign?.status === 'paused') {
    return { skipped: true, reason: 'campaign paused' }
  }
  // proceed with send
}

Wire a PATCH /api/campaigns/:id endpoint that sets status: 'paused' without requiring a code deploy. A pause mechanism that requires a redeploy or infrastructure restart does not satisfy this check.