Upgradeable cores are common in DeFi. Stockline ships an immutable core. That is a product choice, not a missing feature. See the ADRs in the operating-system repo.
Timelock.minDelay is immutable. Launch value is 172,800 seconds (48 hours). Constructor floor is 10 seconds so testnet can use five minutes. Ceiling is 30 days.
Registry
owner() should be this timelock. Identity fields on a book still cannot change after createBook.
Guardian.key calls Stockline.pause / unpause. Pause blocks borrow, withdrawCollateral, liquidate, USDG withdraw. Pause never blocks repay or supplyCollateral. deleverage also stays live. Guardian cannot write RiskRegistry.
Nothing can upgrade Stockline, USDGPool, LiquidationModule, or EquityOracle. Nothing can unpause repay. Nothing can serve a live oracle price from the calendar. Token governance replacing the multisig is later. It is not in this repo.
Related: Access controls, Safety in the app sense, Parameters.
The proposer is a hot key that can only schedule or cancel. Anyone can execute after eta. That split means a compromised proposer cannot steal immediately. It can only queue a parameter change that the delay makes visible.
Identity fields on a book never change after createBook, even through the timelock. Changing a listing means a new oracle from the factory and a new book.
Token governance replacing the multisig is later. Backstop is later. Neither is in this repo. Do not document them as live controls.
Pause never blocks repay. That is the product promise on weekends, holidays, and guardian days. The action table in Architecture and the tests in the contracts repo both check it.