# HYBX OMNL — circuit breakers and operations

## Controls (on-chain)

| Control | Contract | When to use |
|---------|----------|-------------|
| Global pause | `OMNLCircuitBreaker.setGlobalPaused(true)` | Bridge desync, key compromise affecting multiple lines, emergency |
| Line pause | `OMNLCircuitBreaker.setLinePaused(lineId, true)` | Single-asset stress, custodian dispute |
| Stale enforcement | `OMNLCircuitBreaker.setStaleEnforcement(blockM0, blockM1)` | Turn on hard **revert** on mint when `validUntil` passed (default warn-only via API) |

Roles: `GUARDIAN_ROLE` (global), `PAUSER_ROLE` (line), `DEFAULT_ADMIN_ROLE` (stale policy).

## Signals

1. **TTL monitor** — `services/token-aggregation/scripts/omnl-ttl-monitor.mjs` (cron every 1–5 min). Exit 1 → page on-call.
2. **Cross-chain drift** — `GET /api/v1/omnl/mirror-status/:lineId` compares reserve **version** and `r` (requires `OMNL_RESERVE_STORE_138` and `OMNL_RESERVE_STORE_651940`). `GET /api/v1/omnl/health` (needs `OMNL_HEALTH_LINE_ID`) compares compliance snapshots including `reportingCompliant`.
3. **Policy breach** — index `ComplianceSnapshot` events or poll `getCompliance` for `policyOk: false`.

## Runbook: mirror lag

1. Check CCIP message queue / relayer health on primary.
2. Verify `allowedSourceSelectors` on `OMNLMirrorReceiver` (651940).
3. Compare `version` in `ReserveCommitted` events 138 vs 651940.
4. If unrecoverable within SLA: `setGlobalPaused(true)`, investigate, then unpause after replay or manual `commitReserve` alignment.

## Runbook: stale attestation

1. Run custodian pipeline; submit new `commitReserve` on primary with fresh `validUntil`.
2. Mirror to 651940 via CCIP per [CCIP_MIRROR_FLOW.md](./CCIP_MIRROR_FLOW.md).
3. If still stale after SLA: pause M1 mints (`setLinePause` or `setStaleEnforcement`).
