Stylus contracts upgradeable via UUPS, not immutable

Context

Testnet contracts need to evolve as we learn. Immutability is the mainnet promise.

Decision

UUPS upgradeable proxies for all core contracts in Year 1.

Alternatives

Immutable from day 1 (rejected: blocks iteration during the testnet phase).

Consequences

Upgrades are gated by the Praetor multisig + a 48h timelock. Documented as testnet-only; the mainnet flip is a per-contract decision.