The Keeper: The System's Heartbeat

We've followed a whole trade end to end and seen how the money works. Now we open Part 4 with the machinery that keeps all of it running - starting with the quiet robot that never sleeps.

Back in Part 1 we met the off-chain helpers: the Oracle that signs the price, the market makers' quoters, and the Keeper - the heartbeat. This chapter is the Keeper's. Its job sounds dull and is absolutely essential: it keeps the prices on the chain fresh, so that nobody's trade ever settles against a stale number.

Why fresh prices are a problem at all

Here's the thing about a blockchain: it doesn't go fetch anything. It only knows what someone has recently written into it. The Oracle signs a real-world price, but that signed price doesn't magically appear onchain - somebody has to submit it, and somebody has to tell the protocol to re-read it.

And the protocol cares not just about what a price is, but how old it is. Remember the mark - the protocol's working price for an asset, the number every risk check runs on. When Maya mints eTSLA, the contract insists the asset's mark was refreshed recently; the same goes for valuing each vault's collateral in the solvency ledger. Own's risk accounting is deliberately built on these cached marks - valued only from signed oracle prices, never from trade prices - so keeping the cache fresh is keeping the system honest.

The rule has teeth: opening new exposure requires the asset's mark to have been pulled within the last hour. Older than that, and any risk-increasing action is simply blocked until someone refreshes it. Better to pause new minting for a few minutes than to let trades happen against yesterday's number.

So the chain needs a constant trickle of fresh prices and freshly stamped marks. That trickle is the Keeper.

What the Keeper actually does

The Keeper runs a simple loop, over and over, on a short timer. Each pass:

   every cycle:

   1. PUSH   fresh signed prices onto the chain
              (the Oracle's attestations, and Pyth updates)

   2. PULL   asset marks         ──►  "re-stamp eTSLA, eSPY, ... as fresh"

   3. PULL   collateral marks    ──►  "re-value each vault's backing"

   ...then sleep, and do it all again.

Order matters: prices land first, then the marks are pulled from those fresh prices. When a pass finishes, every mark the protocol relies on carries a brand-new timestamp, the one-hour clock resets, and trades flow.

There's a nice side effect hiding in step 3: every time a collateral mark is pulled, the protocol re-applies its safety caps against the new value - so the concentration limits from Chapter 7 track price drift automatically, cycle after cycle, without anyone scheduling a review.

Permissionless plumbing that just pays gas

Here's the reassuring part. The Keeper holds no special power. It can't set prices - the ones it pushes are the Oracle's, signature-checked onchain before acceptance. It can't move anyone's money or change a single risk setting. Every action it takes is permissionless: refreshing a mark, pulling a collateral price, even fulfilling a matured LP withdrawal - these are open calls that any address with a little gas could make.

So what does the Keeper bring? Reliability. It shows up every cycle, pays the gas, and keeps the lights on so nobody has to think about it. If it ever went down, the protocol wouldn't be broken - anyone could step in and do the same job - it would just need someone to do it until the Keeper came back. And because stale marks block only new risk, the failure mode of a dead Keeper is a system that politely stops growing, not one that breaks.

The one promise worth remembering

That asymmetry deserves its own heading, because it's the Keeper chapter's real lesson about the whole protocol:

Staleness only ever blocks actions that add risk. It never blocks the exits.

Minting needs a fresh mark. Opening a borrow needs fresh prices. But closing a position, redeeming an eToken, converting through the PSM on the way out - anything that reduces risk - stays open even when marks have gone old. This is deliberate: it's what keeps in-kind redemption working at 3 a.m. on a Sunday when the stock market is closed and no fresh price exists. The door out is never locked for lack of a heartbeat.

(One careful exception you already know: force-execution demands evidence that's fresh to the minute, because real collateral is leaving the building at a claimed price. Strictness there protects the LPs the claim draws on.)

What just happened

The protocol runs on marks - cached working prices, valued only from signed oracle prices - and refuses to open new exposure against a mark older than one hour.
The Keeper is the heartbeat: each cycle it pushes fresh signed prices onchain, then re-stamps every asset mark and every vault's collateral mark.
Each collateral re-mark also re-applies the safety caps, so limits track price drift automatically.
Everything the Keeper does is permissionless - it holds no special role and just pays the gas; anyone could stand in for it.
Staleness blocks only risk-increasing actions. Redeeming, closing, and exiting stay open with stale marks - only force-execution demands to-the-minute evidence, because it draws on LP collateral.

13. The Keeper: The System's Heartbeat