An alarm that stays on until somebody clears it

A one-shot chime can be missed by a worker whose phone was in a pocket. An emergency here is a state, not a message.

The current talk screen with the emergency control above the push-to-talk ring

Raise, acknowledge, clear

Raising an alert opens a session. Every member sees a banner that persists. Acknowledging says "I have seen this" — it does not clear it. Only the raiser, a moderator or an org admin resolves it.

Acknowledgement and resolution are deliberately different actions, because "someone noticed" is not "someone dealt with it"
A phone that reboots mid-alarm still sees the alert when it reconnects
Every raise, acknowledgement and clear is written to the audit log

It overrides the things that would hide it

An emergency reaches people who have muted the channel, set themselves busy, or gone Solo. That override is the entire point, and it is why the rest of the design is conservative.

Takes the floor from whoever is speaking, so a worker in distress never gets a busy signal
The displaced speaker is told, and their partial recording is still saved
Bypasses Do Not Disturb on Android, which requires a permission the user grants explicitly

The current emergency control, held rather than tapped

Hold, do not tap

The control requires a deliberate hold of about two seconds. A single tap in a pocket would raise a false alarm, and this alert overrides other people's Do Not Disturb.

Each behaviour — alert, DND override, location, auto-open mic, hold-to-confirm — is individually configurable
Rate limited per user, with a cooldown after clearing and an hourly cap per organisation
Organisations can disable it entirely rather than having it half-work

The honest limitation

On an end-to-end encrypted channel, the alert body is sealed under that channel's key. So an org admin watching the console cannot see the location unless the client also seals a copy to the org key.

That is a visible, consent-gated setting — never something we do silently
For the same reason an alert targets one channel rather than broadcasting to many
The channel it targets is stated in the interface, so it is known before it is needed

A button that silently fails is worse than no button

This is a safety feature, so it is built as real state with real delivery guarantees rather than a notification that hopes for the best.

Read the security model