We assume that the global kill switch is a one-way toggle in production code. If it can be flipped back off, that unleashes a bunch of new race conditions that we shouldn't need to think about. Luckily it is only used from test code. At the very least we should mark it as test only to ensure it doesn't get used in production code. It may also be worth checking if the tests can easily be modified to not require that function at all, but it probably isn't worth putting too much time into that if it proves tricky.