> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mystockline.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Governance

> What the timelock controls and what nothing can change.

Parameters move. Accounting does not.

The timelock stands in front of the registry. The guardian stands next to the core with pause only.

<Info>
  Upgradeable cores are common in DeFi. Stockline ships an immutable core. That is a product choice, not a missing feature. See the ADRs in the operating-system repo.
</Info>

`Timelock.minDelay` is immutable. Launch value is [172,800 seconds](/resources/parameters) (48 hours). Constructor floor is 10 seconds so testnet can use five minutes. Ceiling is 30 days.

| Role     | Can                                         |
| -------- | ------------------------------------------- |
| Proposer | `schedule`, `cancel`                        |
| Anyone   | `execute` after `eta`                       |
| Nobody   | Change `minDelay`, send ETH, `delegatecall` |

Registry `owner()` should be this timelock. Identity fields on a book still cannot change after `createBook`.

`Guardian.key` calls `Stockline.pause` / `unpause`. Pause blocks borrow, withdrawCollateral, liquidate, USDG withdraw. Pause never blocks repay or supplyCollateral. `deleverage` also stays live. Guardian cannot write `RiskRegistry`.

Nothing can upgrade `Stockline`, `USDGPool`, `LiquidationModule`, or `EquityOracle`. Nothing can unpause repay. Nothing can serve a live oracle price from the calendar. Token governance replacing the multisig is later. It is not in this repo.

Related: [Access controls](/resources/access-controls), [Safety in the app sense](/resources/security), [Parameters](/resources/parameters).

The proposer is a hot key that can only schedule or cancel. Anyone can execute after eta. That split means a compromised proposer cannot steal immediately. It can only queue a parameter change that the delay makes visible.

Identity fields on a book never change after createBook, even through the timelock. Changing a listing means a new oracle from the factory and a new book.

Token governance replacing the multisig is later. Backstop is later. Neither is in this repo. Do not document them as live controls.

Pause never blocks repay. That is the product promise on weekends, holidays, and guardian days. The action table in Architecture and the tests in the contracts repo both check it.