cNGN issuer pause and proxy upgrade are absent from the documented trust assumptions

cNGN is issuer-controlled: it can be paused, and it sits behind an upgradeable proxy. docs/PROTOCOL_SPEC.md §4 lists the ERC-20 dependency as "Standard transfer/transferFrom; SafeERC20" with failure mode "Tx reverts", and §5 enumerates the trusted roles without including the token issuer — a party with more authority over user funds than any role the specification does list.

Every fund-moving path in the protocol is a push transfer. A pause or a targeted blocklist therefore converts the documented "tx reverts" into a permanent stall wherever the reverting call is the only exit from a state.

Vulnerable Scenario: The following steps illustrate the issue:

1. A dispute reaches Tallied with ruling ReleaseSeller. The three seated jurors each hold activeAssignments == 1.
2. The issuer pauses cNGN, or upgrades the proxy to blocklist the seller's address for reasons unrelated to this deal.
3. Any caller invokes execute. The pool calls escrow.resolveDisputeByArbitrator(seller), which reaches safeTransfer(seller, ...) in _resolveDisputeFunds and reverts.
4. The entire execute transaction reverts. The case stays Tallied, the escrow stays Disputed, and the juror-release loop below the external call never runs.
5. Every subsequent execute fails identically. The jurors cannot unstake, because activeAssignments has exactly one decrementer and it sits past the reverting call.
6. If the block was a targeted blocklist rather than a global pause, lifting the pause does not clear it. The only remaining exit is mutual agreement, which also requires a working transfer.

A party outside the protocol's stated trust boundary can freeze disputed principal indefinitely and, through the proxy, change token semantics under live escrows. Jurors seated on an affected case lose access to their entire stake with no administrative cure.

The product is presented as non-custodial; an undocumented issuer holding pause and upgrade authority is a material qualification of that claim, and users cannot weigh a risk that is not recorded.

Record the issuer's actual powers in docs/PROTOCOL_SPEC.md §5 and correct §4's failure mode from "tx reverts" to the stall behaviour above. This is the load-bearing part: a global pause halts every transfer, so no contract change can settle a deal while it is in force, and the only remedy available is that anyone relying on the protocol can see the dependency.

Release juror assignments independently of settlement success. execute performs the external settlement call before its juror-release loop, so a reverting transfer skips the release entirely and strands every seated stake with no administrative cure. Moving the release above the call, or recording a retryable settlement-failure state, removes that harm on its own and is much smaller than the change below.

Then make settlement pull-based: have execute record each party's entitlement and let each withdraw separately, so a single blocked recipient cannot hold the other party's funds and the case hostage. When making that change, compute sweepExcessTokens' escrowed balance from outstanding entitlements as well as from totalAmount - releasedAmount - abandonedAmount, otherwise a recorded award becomes sweepable surplus and the losing party can take the winner's entitlement.

Fixed. Dispute settlement now records entitlements and parties withdraw, so an issuer pause no longer strands the case or its jurors. The remaining push-based exits and the assumption itself are documented in the specification.

• contracts/ArbitrationPool.sol#L957-L993
• contracts/Escrow.sol#L702-L766
• contracts/Escrow.sol#L411-L418
• docs/PROTOCOL_SPEC.md