The kill switch

Owner or emergency key: pause and revoke. Unpause is owner-only. A compromised emergency key can only over-protect.

Float console exposes Pause, Revoke via bot, and owner withdraw. The Telegram bot is the same emergency surface: /pause, /revoke, /status, /link. No trade, spend, or withdraw commands.