Defining off.
If a nuclear reactor still requires 10,000 gallons of water an hour to keep cool even months after it stops generating power than the design is inherently unsafe.
I would not consider it truly disaster resistant unless it goes cold in under 48 hours and requires no external power to maintain a safe temperature.
If a safe temperature is 300 degrees F than the system had better have adequate natural circulation cooling to capture boil off and allow the liquid to return to the reactor.
The designs are top secret, but it is commonly assumed that the reactors in US Navy subs have such a safe loop mode that minimizes the use of circulating pumps for slow speed silent running. Being completely submerged simplifies access to cooling water, but the basic designs already exist.
