The Keeper: The System's Heartbeat

We've followed a whole trade end to end and seen how the money works. Now we open Part 4 with the machinery that keeps all of it running - starting with the quiet robot that never sleeps.

Back in Part 1 we met three off-chain helpers: the Oracle that tells the price, the Market Maker that quotes and hedges, and the Keeper - the heartbeat. This chapter is the Keeper's. Its job sounds dull and is absolutely essential: it keeps the prices on the chain fresh, so that nobody's trade ever stalls on a stale number.

Why fresh prices are a problem at all

Here's the thing about a blockchain: it doesn't go fetch anything. It only knows what someone has recently written into it. The Oracle agrees on a real-world price and signs it, but that signed price doesn't magically appear on the chain - somebody has to actually submit it.

And the protocol cares not just about what the price is, but how old it is. Remember the mark - the protocol's working price for an asset, the number it uses for its safety math. When Maya mints eTSLA, the contract checks the mark to make sure the trade keeps everything solvent and within caps (we'll cover those guardrails in the next chapter). If that mark is too old, the protocol simply refuses to act on it.

That's the staleness guard (engineers call a too-old mark a "stale mark"). The rule is: a mark older than the maxMarkAge - 15 minutes by default - is treated as untrustworthy, and any risk-increasing action that depends on it is blocked. Better to pause new minting for a few minutes than to let trades happen against a price that might be badly out of date.

So the chain needs a constant trickle of fresh prices and freshly-stamped marks. That trickle is the Keeper.

What the Keeper actually does

The Keeper runs a simple loop, over and over, on a short timer (about once a minute). Each pass does three things in order:

   every ~60 seconds:

   1. PUSH   fresh signed prices  ──►  onto the chain
              (from the Oracle's proof)

   2. PULL   asset marks          ──►  "re-stamp eTSLA, eGOLD, ... as fresh"

   3. PULL   collateral marks     ──►  "re-value each vault's backing"

   ...then sleep, and do it all again.

First it grabs the latest signed price proofs from the Oracle and writes them onto the chain. Then it nudges the protocol to re-read those prices into its working marks - once for each tradeable asset, and once for the collateral backing each vault. Order matters: prices land first, then the marks are pulled from those fresh prices.

When the loop finishes, every mark the protocol relies on carries a brand-new timestamp. The 15-minute clock resets. Trades flow.

Permissionless plumbing that just pays gas

Here's the reassuring part. The Keeper holds no special power. It can't set prices, can't move anyone's money, can't change a single risk setting. Every action it takes is permissionless - anyone with a wallet and a little gas could do exactly the same thing. The price it pushes is the Oracle's signed price, and the chain verifies that signature before accepting it. The "pull" steps are open calls that any address is allowed to make.

So what does the Keeper bring? Reliability. It shows up every minute, pays the gas, and keeps the lights on, so that nobody has to think about it. If the Keeper ever went down, the protocol wouldn't be broken - anyone could step in and push the prices - it would just need someone to do that job until the Keeper came back.

The Keeper is also built to be paranoid about its one job. It checks its own gas balance and warns if it's running low. If one of its transactions gets stuck unconfirmed - blocking everything behind it - it detects the jam and resends at a higher fee to clear it. And it has a "dead-man's switch": it sends a steady all-clear ping only when a cycle goes perfectly, so an outside monitor notices the silence the moment anything goes wrong.

The one promise worth remembering

The staleness guard only ever blocks actions that add risk - new minting, opening fresh exposure. It never blocks the exits.

This is deliberate and important. Closing a position, redeeming an eToken, an LP pulling collateral out - anything that reduces risk - is always allowed, stale mark or not. So even in the worst case, where the Keeper has failed and prices have gone old, you are never trapped. The door out is never locked. The only thing a stale mark can do is politely pause new business until someone refreshes the numbers.

What just happened

A blockchain only knows prices that someone recently wrote into it, and the protocol refuses to act on a mark that's gone stale (the staleness guard, with a 15-minute maxMarkAge).
The Keeper is the heartbeat: roughly once a minute it pushes the Oracle's fresh signed prices onto the chain, then re-stamps each asset mark and each vault's collateral mark.
Everything the Keeper does is permissionless - it holds no special role, sets no prices, and just pays the gas; anyone could do the same job.
It watches itself carefully: low-gas warnings, stuck-transaction recovery, and a dead-man's-switch heartbeat that alerts on silence.
Risk-reducing actions - redeeming, closing, withdrawing - are never blocked by a stale mark. The exit is always open.

13. The Keeper: The System's Heartbeat