Emergency powers, and their limits

We believe emergency powers should be embarrassing to use and impossible to abuse:

• Pause: the guardian multisig can pause a vault or the protocol for at most 72 hours per declared incident, after which redemption force-unlocks regardless of anyone's opinion.
• Wind-down: liquidate-to-cash-only, for discontinued assets. Cannot be used to acquire user funds; proceeds are redeemable by depositors only.
• Venue allowlist: execution venues are allowlisted by the protocol owner on the adapter. A new venue cannot redirect funds — the adapter's invariants (proceeds must land in the vault, output must be a mandate asset, price must clear the Chainlink-mid floor) hold no matter which venue is called. A public timelock on venue additions is a v2 hardening, not a v1 claim.
• What doesn't exist: upgrade keys on vault logic, fund-transfer admin functions, blacklists, mandate overrides. We can't do these things because we chose not to be able to.