Emergency controls & off-switches

devnet preview — all data is replay

No emergency control exists for settlement (§26 — settlement is not in the control set; emergency actions are forward-looking and cannot alter matched terms). Once matched, nothing can stop it — not operators, not governance, not us. Below is every switch that does exist, and what it cannot do.

Read this before you compose the table yourself. Two of these controls, combined, can freeze exit indefinitely: pausing withdrawals blocks both request and finalize, and a paused withdrawal can be voided back to its owner. No combination moves money anywhere except back to whoever owned it — but exit can be frozen, and you should know that from us first.

The controls

control	what it can do	what it cannot do
pause bridge / resume	blocks new deposits and/or withdrawals by mode; withdrawals mode blocks both request and finalize	non-retroactive on balances and records; existing liabilities remain recorded
pause matching / resume	blocks new lease creation	existing leases and challenge windows continue untouched
pause provider / resume	blocks new obligations and leases for one provider	existing obligations remain slashable — a pause cannot shield a provider
pause book / resume	blocks new clearing for one listed book	existing leases continue to settlement
cancel withdrawal	voids a requested withdrawal — callable only while withdrawals are paused, under the same authority; funds return to the owner's available balance; a cancelled withdrawal can never finalize	cannot redirect value anywhere except back to its owner
settlement	no switch exists	once matched, nothing can stop or rewrite it

Every control is validated in consensus, emits an event with a reason code, and is bound by one rule: emergency actions are forward-looking and cannot retroactively alter matched economic terms.

Implementation status. Wired today: PauseBridge / ResumeBridge, CancelWithdrawal. Specified, not yet wired: matching, provider, and book pauses. The table above is the signed §26 control set; the three not-yet-wired pauses are rejected in consensus until their handlers land, and this page will say so until they do.

The off-switch list

An honest enumeration of every centralized dependency, one line each:

the validator set	today: nodes we run on devnet. Decentralizing it is the roadmap, not the present.
the Base bridge	deposits and withdrawals cross it; it is pausable (see above) and carries a delay window by design.
the USDC issuer	the settlement asset has a freeze function we do not control.
the relay	anyone can run one with no privileges; ours is the dominant client today.
the audit program	does not exist yet. Listed because the quality-audit design depends on it — a dependency we owe, not one we have.
this front-end	the dominant way people will read the market. Mirrors are welcome; the feed needs no key.