Pausing, Resuming, and Cancelling

You can pause a running Backstory investigation, resume it, cancel it, watch someone else's, and hand control of yours to a colleague. The controls are slightly different for a run streaming into your tab and a run executing in the background, so this page covers both.

How do I pause an investigation running in my tab?

Press Pause on the investigate page. Press it again to resume.

A pause takes effect at the next step boundary rather than mid-action, so anything already in flight finishes and lands in the graph. That is why the graph may keep filling in for a moment after you press it. Nothing is lost by pausing, and nothing is lost by resuming.

Pause when you want to read what has arrived before more arrives, or when you want to take a pivot yourself before Backstory chooses the next one. It is a reading aid as much as a control.

What happens if I close the tab?

The investigation keeps running and saves when it finishes. Find it on the Investigations page.

Closing the tab is not a cancel. The run is not tied to your connection, so a dropped network or an accidental close does not cost you the work. What you lose is the live view, and you can get that back by attaching to the run.

A live run with nobody watching is not guaranteed to continue indefinitely, so if you know you are going to walk away for a while, start it in the background instead. That is what background runs are for.

How do I control an investigation running in the background?

From the Investigations page. Active runs sit in their own group at the top of the list, and each row carries its controls: Attach, Pause or Resume, and Cancel.

• Attach opens the live view of the run, wherever it is up to.
• Pause asks the run to stop at its next step boundary. The row shows the pause as pending until the run acknowledges it, which is honest about the fact that the request and the stop are not the same instant.
• Resume clears the pause.
• Cancel stops a queued run outright, and asks a running one to stop at its next step boundary.

Pause and resume on a background run are restricted to the person who submitted it. Anyone with access can watch it; only its owner can steer it.

Can someone else watch my investigation?

Yes, and this is worth using during an incident.

Anyone whose access covers the environments the run is working in can attach to it and watch the same graph and the same log you are seeing, live. Attaching is read-only: watchers cannot pause, resume, or steer. A strip at the top names who currently holds control, so nobody has to guess who is driving.

Two people watching one investigation is the intended shape for handing off a case mid-shift, or for a second pair of eyes on something ugly.

How do I take control of a run someone else started?

Use Take control, which is offered once the current holder is no longer attached and a short grace period has passed.

The grace period exists so that a colleague who reloads their tab does not lose control of their own investigation to whoever clicked first. When a transfer does happen it is announced to everyone watching, and the strip updates, so control is always visible rather than implicit.

What happens to a paused investigation nobody resumes?

It finishes with what it has, rather than sitting paused forever.

A background run left paused eventually concludes and writes its report from the evidence collected up to that point. This is the deliberate choice: a forgotten pause gives you a partial report you can read, not a run stuck in limbo and not a run quietly spending its way through the rest of the case. Read the report's gaps section, which will tell you what was still open when it stopped.

Does an interrupted investigation start over?

No. A background run that is interrupted by infrastructure picks up from its last checkpoint rather than restarting from the seed, and anyone watching keeps their place in the event stream.

If you are driving investigations through the API, the job's attempt count is where you see this happen. A rising attempt count is the resume working, not a sign the investigation is confused.

What should I read next?

• Starting an Investigation, for the live versus background choice this page's controls depend on.
• Reading the Investigation Graph, for the per-node actions that let you steer a paused run yourself.
• Sharing a Backstory Report, for what to do once it has finished.