When It Stops
What happens when Beemy stops. Not what happens when Beemy is wrong.
Every other page on this site answers what happens when Beemy gets a call wrong. This one answers a different question: what happens to your mail, and to whatever Beemy was mid-way through, the moment Beemy itself is unavailable, interrupted, or mid-job.
The short version
Your Gmail grant can't delete, move, label or edit a message, so an outage can't lose your mail. The pipeline stops rather than guesses at four separate points. A half-done item waits, unlost, in intake. One narrow case can leave a recoverable duplicate, and we say so. There's no status page, no SLA, no automatic retry, and no uptime figure yet.
On this page
Your mailbox cannot change
Beemy's Gmail grant can only read and send.
Every scope Beemy asks Google for is set once, in one place, and checked against an allowlist. There is no scope on that list that can delete, move, label or edit a message.
Beemy's Gmail grant is capped at read and send. No scope Beemy may hold can delete, move, label or edit a message. If Beemy stops, your mail stacks up in Gmail exactly as if Beemy had never connected.
CONNECTOR_REGISTRY · backend/src/connectors/registry.ts, CONNECTOR_REGISTRY (gmail entry)
If Beemy stops for a minute or a month, your Gmail is exactly as you left it. Nothing about your mail changes because Beemy did.
It stops. It does not guess.
Four points where the code stops rather than guesses.
An interruption anywhere in the pipeline meets one of these four gates. Each one chooses to stop over acting on an assumption.
An unclear message waits for you rather than getting filed on a guess.
When a message's confidence score, or its margin over the runner-up, misses its bar, the pipeline quarantines it instead of filing it anywhere.
decide · backend/src/pipeline/pipeline.ts, decide()
An ungraded model never passes.
The quality ledger returns false for any model and task pair it has never scored. A model this ledger has not measured is treated as failing, not as an open question.
meetsBar · backend/src/eval/quality.ts, QualityLedger.meetsBar
A router with nowhere left to go stops, it doesn't improvise.
When every provider on the router's allowlist fails a call in turn, the router throws. It never returns a lower-quality answer, and it never returns an empty one.
dispatch · backend/src/model/modelRouter.ts, ModelRouter.dispatch()
An unrecognised provider stops the gateway, not your inbox.
If the configured model provider isn't one this code ships, the gateway throws rather than silently falling back to a default provider.
getModelProvider · backend/src/model/index.ts, getModelProvider()
What happens to a half-done item
An item mid-move waits. It doesn't vanish.
A half-done item waits in intake rather than getting lost.
Filing a message into a silo writes the destination copy first. Only once that write succeeds does the intake copy get cleared. A crash in between leaves the item waiting in intake, not lost.
commitToSilo · backend/src/pipeline/mover.ts, ReclassificationService.commitToSilo
Moving an already-filed item between two silos is a different operation, with a different honest limit.
The one case that leaves a duplicate, and why.
Moving an item from one silo to another writes the new copy first, then deletes the old one. No single database transaction can span both silos' access keys, so a crash between those two steps can leave a recoverable duplicate under the old silo's key. That is not a leak, and it is not data loss.
moveBetweenSilos · backend/src/pipeline/mover.ts, ReclassificationService.moveBetweenSilos
The honest limits, today
What we don't have yet, stated plainly.
There is no status page today.
There is no service-level agreement today.
There is no automatic retry and no backoff in the code today. A failed call fails; it is not quietly reattempted behind your back.
This page publishes no uptime figure. A private-beta, self-reported number would fail the same sourcing bar every other statistic on this site has to clear.
A wrong answer and no answer are different failures
How this page differs from "When it gets it wrong".
When it gets it wrong covers a wrong call. Triage might misjudge a message, or a draft might land in the wrong tone. This page covers a different failure. It covers Beemy not answering at all, because it stopped, was interrupted, or crashed mid-job.
A wrong answer and no answer are not the same failure, and they don't call for the same fix. You correct a wrong call with a tap. The four points above, and a mailbox Beemy was never able to touch, contain the other failure.
Read next
Get your time back.
Beemy is in private beta. Join the waitlist and go from connect to a quiet, triaged inbox before you close your laptop tonight.
You're in the hive. We'll buzz you when it's your turn.
While you waitLast updated