Pausing

Three contracts are Pausable, and each pause is deliberately narrow. Pausing never locks user funds.

What each pause stops

GravityStaking.pause(): Blocks stake only. Claiming, withdrawing at maturity and emergency withdrawal all continue to work.
BuybackExecutor.pause(): Blocks executeBuyback. Funding still works, so the budget keeps accumulating.
PloutoRevenueRouter.pause(): Blocks routeUnallocatedRevenue. Claiming is not pausable, so a pause can never strand fees in the escrow.

What is never pausable

Function	Why
`claim` / `claimMany`	Rewards already earned must remain collectible.
`withdraw`	Matured principal must remain withdrawable.
`emergencyWithdraw`	Its entire purpose is to work when things are wrong.
`claimPonsFees`	Pausing it would leave revenue stranded in Pons.
`executeWithdrawal` on the reserve	The timelock is the control there, not a pause.

Who can pause

PAUSER_ROLE, granted to the admin at deployment and intended to be transferred to a multisig. Unpausing requires the same role.

What the interface does

A paused contract is reflected honestly. The staking panel shows:

Staking is paused. Claims and matured withdrawals are unaffected.

and disables the form rather than letting a transaction fail on chain. If an emergency has also been declared, the message says so and the emergency exit appears on each position.

The state is read live from paused() and emergencyMode(), so it is never stale.

When to pause

A suspected bug in a code path.
Anomalous buyback behaviour — pause the executor, keep the budget.
Anomalous staking behaviour — pause staking, leave exits open.
During an incident investigation, to stop new exposure accumulating.

When to escalate

If principal itself is at risk rather than a peripheral function, pausing is not enough. Declare an emergency, which pauses staking and opens the principal-only exit. See emergency withdrawal.

Events

Paused(address) and Unpaused(address) from OpenZeppelin. Watch them if you want to know the moment protocol state changes.