Pause a job at runtime to skip scheduled runs until the pause expires or you resume it. Pauses last one hour by default and at most thirty days. To stop a job indefinitely, set enabled: false in its configuration.

Pause and resume are available through the HTTP API, the web dashboard and terminal dashboard (p or the drawer button), and the cron_pause_job and cron_resume_job MCP tools.

POST /jobs/{name}/pause takes an optional JSON body:

An empty or absent body pauses for the default hour. The response is 200 with the pause record, where channel records which surface acted (api, mcp):

$ http post http://127.0.0.1:8080/jobs/nightly-etl/pause durationSeconds:=7200 note="upstream DB migration" by=parker
{
    "paused": {
        "since": "2026-07-19T14:00:00+00:00",
        "until": "2026-07-19T16:00:00+00:00",
        "note": "upstream DB migration",
        "by": "parker",
        "channel": "api"
    }
}

To extend or change a pause, pause the job again. An unknown job returns 404. Invalid inputs return 400:

• both durationSeconds and until
• an until value in the past or more than thirty days away
• an out-of-range duration
• a wrong type
• an oversized note/by

POST /jobs/{name}/resume (optional body: by) ends the pause immediately and returns {"paused": null}. Resuming a job that is not paused is a no-op with the same response. Both routes are mutating: they sit behind web.authToken and the cross-site request defense like start and cancel.

• Scheduled fires are skipped, visibly. Each due slot gets a synthetic row in the run ledger with outcome skipped and skip_reason: "paused" (no started_at, no exit_code), so the history records a due fire that was deliberately not run, instead of a silent gap. The dashboards show these rows neutrally, and they stamp no success or failure state.
• Pending retries defer. A pending retry waits until the job resumes, preserving its attempt number and retry budget.
• Catch-up skips the pause window. Missed-run catch-up excludes slots within recorded pause windows, including daemon downtime, and covers slots after expiry. If the job is paused during boot evaluation, catch-up waits with its pre-pause watermark saved in an open checkpoint. After resume, it replays the backlog from before the pause or closes the checkpoint if nothing is owed. Disabling the job or setting onMissed: skip also closes the checkpoint; later catch-up starts from the run ledger.
• Manual start still works. POST /jobs/{name}/start can launch a paused job; a disabled job returns 409. Cancellation also remains available.
• Running instances are unaffected. Pausing stops future fires. It never touches a run already in progress.
• The pause sticks to the name. Config reloads and edits to the job leave an active pause in place. Only removing the job from the config drops it.

While paused, the job's service level agreement (SLA) checks are suppressed. Slots skipped during a pause do not count as late.

A pause stops applying when its until deadline passes. The daemon removes the expired entry and logs the automatic resume during housekeeping, once per wall-clock minute. A restart after the deadline ignores the expired pause.

Without a state: store, a pause is in-memory: a daemon restart forgets it and the schedule resumes. With one, each pause and resume appends a record to the job's durable paused/<job> stream (newest record wins), so:

• a pause survives restarts: boot rehydrates the active windows before the first fire;
• a pause is fleet-wide: every node sharing the store honors it, whichever node accepted the request. The record's host field is audit information only. Peers pick up a pause or resume on their housekeeping pass, so cross-node propagation takes up to about a minute. The node that handled the request applies it immediately.

Scheduling never reads the store. Fire-time checks are memory-only. If the store cannot be read, each node keeps its last known in-memory pause state and logs a warning, under either onStoreUnavailable policy. A pause is an operator convenience, not a correctness fence, so an unreadable store neither resurrects nor drops pauses, and never blocks firing.

• Late-Run Detection: the SLA checks a pause suppresses.
• HTTP Control API: the endpoint reference, authentication, and error shapes.
• Durable State: the store behind restart survival and fleet-wide pauses.
• Failure Detection and Retries: how pending retries wait until a pause ends.
• Why Didn't It Run?: probing one timestamp, pause note included.