# Upgrade & Immutability Status

## 4.4 Upgrade & Immutability Status

This page defines whether Modulexo contracts are upgradeable, owner-controlled, governance-controlled, or fully immutable.

All statements must be verified on-chain via:

• `owner()`\
• Proxy admin address\
• Implementation address\
• Ownership transfer events

***

## I. Upgrade Model Classification

Each contract belongs to one of the following categories:

1. **Immutable (No Proxy, Ownership Renounced)**
2. **Owner-Controlled (No Proxy)**
3. **Governance-Controlled (No Proxy)**
4. **Upgradeable via Proxy (Owner or Governance Controlled)**

The status must be explicitly listed per contract in Contract Directory.

***

## II. Execution Layer (Recycle Contracts)

### RecyclingEngine

Verify:

• Is contract a proxy?\
• If proxy:

* Proxy address
* Implementation address
* Proxy admin address\
  • If not proxy:
* Code immutable after deployment

Verify:

```
owner()
```

Possible states:

• Private Owner\
• Timelock\
• Zero address (renounced)

If ownership renounced:

Parameter updates are permanently disabled.

If ownership transferred to Timelock:

Upgrades or parameter changes require governance proposal.

***

### SponsorshipLedger

Same verification steps apply:

• Proxy or not\
• Owner or Timelock\
• Renounced or active

Ledger math itself is immutable unless contract upgradeable via proxy.

***

### RecycleAssetRegistry

Asset enablement and caps depend on ownership state.

If owner active:

Asset list mutable.

If renounced:

Registry frozen.

***

## III. Router

Verify:

• Proxy status\
• Owner

Router rail configuration is mutable only if owner active.

If ownership renounced:

Rail topology becomes permanent.

***

## IV. Fund (Ethereum)

Fund may be:

• Direct deployment (immutable code)\
• UUPS / Transparent Proxy (upgradeable)

If proxy:

List:

• Proxy address\
• Implementation address\
• Proxy admin

Ownership must equal Timelock for governance control.

If proxy admin retained by private address:

Upgrade risk remains.

This must be disclosed.

***

## V. Governance Contracts

### Weighted Governor

Typically immutable.

Verify:

• No proxy admin\
• Constructor parameters fixed

***

### Timelock

Verify:

• `getMinDelay()`\
• Admin role assignments

If Timelock admin is self-governed:

Upgrade path is constrained by governance.

***

## VI. Upgrade Authority Matrix

| Contract        | Proxy? | Owner    | Upgrade Authority  | Immutable? |
| --------------- | ------ | -------- | ------------------ | ---------- |
| RecyclingEngine | Yes/No | Address  | Owner / Governance | Depends    |
| Ledger          | Yes/No | Address  | Owner / Governance | Depends    |
| Registry        | Yes/No | Address  | Owner / Governance | Depends    |
| Router          | Yes/No | Address  | Owner              | Depends    |
| Fund            | Yes/No | Timelock | Governance         | Depends    |

This matrix must be filled with real deployment data.

***

## VII. What Cannot Be Changed (If Immutable)

If contracts are non-proxy and ownership renounced:

The following become permanent:

• Distribution formula\
• Weight mint logic\
• Unit consumption logic\
• Burn routing\
• Rail math\
• Governance structure

No upgrade path exists.

***

## VIII. Proxy Risk Disclosure

If any contract uses a proxy pattern:

Risks include:

• Implementation upgrade\
• Admin key compromise\
• Governance manipulation

Verify:

```
implementation()
admin()
```

on proxy contract (if applicable).

Upgrade events must be monitored.

***

## IX. Parameter Freeze State

If `renounceOwnership()` called:

Parameter update functions become inaccessible.

Verify via:

```
owner() == address(0)
```

This permanently disables:

• setParams\
• setAsset\
• setRails

Freeze state must be documented.

***

## X. Governance Lock Scenario

If:

• All execution contracts owned by Timelock\
• Fund owned by Timelock\
• Timelock controlled by Governor

Then system upgrades require:

1. Proposal
2. Vote
3. Delay
4. Execution

No unilateral change possible.

***

## XI. Immutability Summary Categories

#### Category A — Fully Immutable

• No proxy\
• Owner renounced

Permanent.

***

#### Category B — Governance Controlled

• Owner = Timelock\
• No private admin

Upgradeable via governance.

***

#### Category C — Owner Controlled

• Owner is private address

Upgradeable or mutable without governance.

***

Each contract must be assigned one category.