upgrade_registry state

ContractEntry

ContractEntry represents a registered contract and its upgrade status. An entry's Address is ALWAYS the address that called Register — a contract can only register itself. That call is the proof of control: nobody can claim an address they don't command, so a Deprecate redirect on an entry always originates from whoever genuinely controlled the contract. Entries are permanent by design: migration history is what consumers rely on, so it must not be erasable (and a delete would reopen re-registration squatting). Ownership is two-step (re-audit 2026-09-02): Register/Transfer only NOMINATE an owner; the nominee must AcceptOwnership. Until then the entry is owned by the contract itself, so nobody's address can be attached as "owner" without their consent.

MaxNameLen

MaxChainLen

// GetMigrationChain traversal/output bound (marked when hit)

MaxRenderEntries

RenderLatestHops

entries

entryAddrs

// insertion-ordered for deterministic Render

ownerContracts

init.8

rejectStraySend

rejectStraySend aborts when coins are attached to a call (audit Y2): this realm handles no funds and holds no banker, so an attached send would strand on the realm address forever. Aborting reverts the transfer back to the sender. Fails open for realm-routed calls, whose attached send lands on the intermediary realm, never here.

isValidName

isValidName restricts names to lowercase alphanumeric with underscores. Names appear in rendered markdown and query output, so no delimiter or markdown character may enter one.

ownerIndexRemove

Register

Register adds the CALLING contract to the registry — the entry's address is the caller's own address, which is the proof of control. owner NOMINATES a manager (team EOA or governance realm); it holds no power until it calls AcceptOwnership (nobody can be made an owner without consent — re-audit). Pass "" to manage from the contract itself — but note (audit Y4): entries are permanent, so an entry managed by a contract that has no code path for calling this registry again is FROZEN as active forever: never deprecatable, never transferable. Realms registering from init() should nominate an EOA or governance manager instead.

AcceptOwnership

AcceptOwnership completes a nominated ownership: only the pending owner can accept, and only acceptance moves the entry (and the ownerContracts index) to them.

TransferOwnership

TransferOwnership NOMINATES a new owner for a registry entry; the nominee must AcceptOwnership to take control (two-step — re-audit). Passing "" clears a pending nomination.

Deprecate

Deprecate marks a contract as deprecated and points to its successor. Only the entry's owner can deprecate. The successor must itself be a REGISTERED entry — registration is self-proving, so a successor can never be a dangling pointer or an address squatted by a third party — and the successor entry must be OWNED BY THE CALLER (re-audit: without consent, an attacker could chain their entry INTO a legitimate contract, forging "official predecessor" provenance). Consent is checked AT CALL TIME: transferring the successor entry away later does not unlink an existing chain — the attestation is that both ends shared an owner when the deprecation was recorded.

GetLatest

GetMigrationChain

GetMigrationChain returns the full upgrade path starting from the given address, at most MaxChainLen hops. A chain longer than the bound is explicitly marked as truncated (re-audit: silent truncation presented a mid-chain node as the endpoint).

GetInfo

GetInfo returns a one-line summary for a contract.

GetOwnerContracts

GetOwnerContracts returns all contract addresses whose ACCEPTED owner is the given address (nominations don't count until accepted).

renderLatest

Render

Render returns a markdown overview of the most recent entries. Never panics.

mustGet