fix: Add upgrade safety hardening and comprehensive tests

src/DirectDemocracyVoting.sol

@@ -126,7 +126,10 @@ contract DirectDemocracyVoting is Initializable {
     event QuorumPercentageSet(uint8 pct);
 
     /* ─────────── Initialiser ─────────── */
-    constructor() initializer {}
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
+    }
 
     function initialize(
         address hats_,

src/EducationHub.sol

@@ -77,6 +77,11 @@ contract EducationHub is Initializable, ContextUpgradeable, ReentrancyGuardUpgra
     event TokenSet(address indexed newToken);
     event HatsSet(address indexed newHats);
 
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
+    }
+
     /*────────── Initialiser ────────*/
     function initialize(
         address tokenAddr,

src/Executor.sol

@@ -62,6 +62,11 @@ contract Executor is Initializable, OwnableUpgradeable, PausableUpgradeable, Ree
     event HatMinterAuthorized(address indexed minter, bool authorized);
     event HatsMinted(address indexed user, uint256[] hatIds);
 
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
+    }
+
     /* ─────────── Initialiser ─────────── */
     function initialize(address owner_, address hats_) external initializer {
         if (owner_ == address(0) || hats_ == address(0)) revert ZeroAddress();

src/HybridVoting.sol

@@ -117,7 +117,10 @@ contract HybridVoting is Initializable {
     event QuorumSet(uint8 pct);
 
     /* ─────── Initialiser ─────── */
-    constructor() initializer {}
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
+    }
 
     function initialize(
         address hats_,

src/ImplementationRegistry.sol

@@ -50,6 +50,11 @@ contract ImplementationRegistry is Initializable, OwnableUpgradeable {
         bool latest
     );
 
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
+    }
+
     /*───────── Initializer ─────────────*/
     function initialize(address owner) external initializer {
         __Ownable_init(owner);

src/OrgDeployer.sol

@@ -140,7 +140,10 @@ contract OrgDeployer is Initializable {
 
     /*════════════════  INITIALIZATION  ════════════════*/
 
-    constructor() initializer {}
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
+    }
 
     function initialize(
         address _governanceFactory,

src/OrgRegistry.sol

@@ -92,7 +92,9 @@ contract OrgRegistry is Initializable, OwnableUpgradeable {
     event OrgMetadataAdminHatSet(bytes32 indexed orgId, uint256 hatId);
 
     /// @custom:oz-upgrades-unsafe-allow constructor
-    constructor() initializer {}
+    constructor() {
+        _disableInitializers();
+    }
 
     /**
      * @dev Initializes the contract, replacing the constructor for upgradeable pattern

src/ParticipationToken.sol

@@ -70,6 +70,11 @@ contract ParticipationToken is Initializable, ERC20VotesUpgradeable, ReentrancyG
     event MemberHatSet(uint256 hat, bool allowed);
     event ApproverHatSet(uint256 hat, bool allowed);
 
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
+    }
+
     /*─────────── Initialiser ──────*/
     function initialize(
         address executor_,

src/PaymasterHub.sol

@@ -1409,7 +1409,8 @@ contract PaymasterHub is IPaymaster, Initializable, UUPSUpgradeable, ReentrancyG
     function _authorizeUpgrade(address newImplementation) internal override {
         MainStorage storage main = _getMainStorage();
         if (msg.sender != main.poaManager) revert NotPoaManager();
-        // newImplementation is intentionally not validated to allow flexibility
+        if (newImplementation == address(0)) revert ZeroAddress();
+        if (newImplementation.code.length == 0) revert ContractNotDeployed();
     }
 
     // ============ Internal Functions ============
@@ -1762,10 +1763,4 @@ contract PaymasterHub is IPaymaster, Initializable, UUPSUpgradeable, ReentrancyG
     receive() external payable {
         emit BountyFunded(msg.value, address(this).balance);
     }
-
-    /**
-     * @dev Storage gap for future upgrades
-     * Reserves 50 storage slots for new variables in future versions
-     */
-    uint256[50] private __gap;
 }

src/PaymentManager.sol

@@ -63,6 +63,11 @@ contract PaymentManager is IPaymentManager, Initializable, OwnableUpgradeable, R
                                     INITIALIZER
     ──────────────────────────────────────────────────────────────────────────*/
 
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
+    }
+
     /**
      * @notice Initializes the PaymentManager
      * @param _owner The address that will own the contract (typically the Executor)

src/PoaManager.sol

@@ -72,6 +72,7 @@ contract PoaManager is Ownable(msg.sender) {
     /*──────────── Admin: add & bootstrap ───────────*/
     function addContractType(string calldata typeName, address impl) external onlyOwner {
         if (impl == address(0)) revert ImplZero();
+        if (impl.code.length == 0) revert ImplZero();
         bytes32 tId = _id(typeName);
         if (address(beacons[tId]) != address(0)) revert TypeExists();
 
@@ -91,6 +92,7 @@ contract PoaManager is Ownable(msg.sender) {
     /*──────────── Admin: upgrade ───────────*/
     function upgradeBeacon(string calldata typeName, address newImpl, string calldata version) external onlyOwner {
         if (newImpl == address(0)) revert ImplZero();
+        if (newImpl.code.length == 0) revert ImplZero();
         bytes32 tId = _id(typeName);
         UpgradeableBeacon beacon = beacons[tId];
         if (address(beacon) == address(0)) revert TypeUnknown();

src/QuickJoin.sol

@@ -85,6 +85,11 @@ contract QuickJoin is Initializable, ContextUpgradeable, ReentrancyGuardUpgradea
         address indexed master, address indexed account, string username, bytes32 indexed credentialId, uint256[] hatIds
     );
 
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
+    }
+
     /* ───────── Initialiser ───── */
     function initialize(
         address executor_,

src/TaskManager.sol

@@ -168,6 +168,11 @@ contract TaskManager is Initializable, ContextUpgradeable {
     event TaskApplicationApproved(uint256 indexed id, address indexed applicant, address indexed approver);
     event ExecutorUpdated(address newExecutor);
 
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
+    }
+
     /*──────── Initialiser ───────*/
     function initialize(
         address tokenAddress,

src/UniversalAccountRegistry.sol

@@ -41,6 +41,11 @@ contract UniversalAccountRegistry is Initializable, OwnableUpgradeable {
     event UserDeleted(address indexed user, string oldUsername);
     event BatchRegistered(uint256 count);
 
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
+    }
+
     /*────────────────────────── Initializer ────────────────────────────*/
     function initialize(address initialOwner) external initializer {
         if (initialOwner == address(0)) revert InvalidChars();

test/EducationHub.t.sol

@@ -2,6 +2,8 @@
 pragma solidity ^0.8.20;
 
 import "forge-std/Test.sol";
+import "@openzeppelin/contracts/proxy/beacon/UpgradeableBeacon.sol";
+import "@openzeppelin/contracts/proxy/beacon/BeaconProxy.sol";
 
 import {EducationHub, IParticipationToken} from "../src/EducationHub.sol";
 import {ValidationLib} from "../src/libs/ValidationLib.sol";
@@ -63,7 +65,9 @@ contract MockPT is Test, IParticipationToken {
             hats.mintHat(MEMBER_HAT, creator); // creator is also a member
             hats.mintHat(MEMBER_HAT, learner);
 
-            hub = new EducationHub();
+            EducationHub _hubImpl = new EducationHub();
+            UpgradeableBeacon _hubBeacon = new UpgradeableBeacon(address(_hubImpl), address(this));
+            hub = EducationHub(address(new BeaconProxy(address(_hubBeacon), "")));
             uint256[] memory creatorHats = new uint256[](1);
             creatorHats[0] = CREATOR_HAT;
             uint256[] memory memberHats = new uint256[](1);
@@ -87,7 +91,9 @@ contract MockPT is Test, IParticipationToken {
         }
 
         function testInitializeZeroAddressReverts() public {
-            EducationHub tmp = new EducationHub();
+            EducationHub _tmpImpl = new EducationHub();
+            UpgradeableBeacon _tmpBeacon = new UpgradeableBeacon(address(_tmpImpl), address(this));
+            EducationHub tmp = EducationHub(address(new BeaconProxy(address(_tmpBeacon), "")));
             uint256[] memory creatorHats = new uint256[](0);
             uint256[] memory memberHats = new uint256[](0);
             vm.expectRevert(EducationHub.ZeroAddress.selector);

test/Executor.t.sol

@@ -2,6 +2,8 @@
 pragma solidity ^0.8.20;
 
 import "forge-std/Test.sol";
+import "@openzeppelin/contracts/proxy/beacon/UpgradeableBeacon.sol";
+import "@openzeppelin/contracts/proxy/beacon/BeaconProxy.sol";
 import "../src/Executor.sol";
 import "./mocks/MockHats.sol";
 
@@ -22,7 +24,9 @@ contract ExecutorTest is Test {
 
     function setUp() public {
         hats = new MockHats();
-        exec = new Executor();
+        Executor impl = new Executor();
+        UpgradeableBeacon beacon = new UpgradeableBeacon(address(impl), address(this));
+        exec = Executor(payable(address(new BeaconProxy(address(beacon), ""))));
         exec.initialize(owner, address(hats));
         target = new Target();
         exec.setCaller(caller);

test/ImplementationRegistry.t.sol

@@ -2,13 +2,17 @@
 pragma solidity ^0.8.20;
 
 import "forge-std/Test.sol";
+import "@openzeppelin/contracts/proxy/beacon/UpgradeableBeacon.sol";
+import "@openzeppelin/contracts/proxy/beacon/BeaconProxy.sol";
 import "../src/ImplementationRegistry.sol";
 
 contract ImplementationRegistryTest is Test {
     ImplementationRegistry reg;
 
     function setUp() public {
-        reg = new ImplementationRegistry();
+        ImplementationRegistry _regImpl = new ImplementationRegistry();
+        UpgradeableBeacon _regBeacon = new UpgradeableBeacon(address(_regImpl), address(this));
+        reg = ImplementationRegistry(address(new BeaconProxy(address(_regBeacon), "")));
         reg.initialize(address(this));
     }
 

test/Passkey.t.sol

@@ -157,7 +157,9 @@ contract PasskeyTest is Test {
         mockExecutor = new MockExecutor();
 
         // Deploy account registry
-        accountRegistry = new UniversalAccountRegistry();
+        UniversalAccountRegistry _uarImpl = new UniversalAccountRegistry();
+        UpgradeableBeacon _uarBeacon = new UpgradeableBeacon(address(_uarImpl), owner);
+        accountRegistry = UniversalAccountRegistry(address(new BeaconProxy(address(_uarBeacon), "")));
         accountRegistry.initialize(owner);
 
         vm.stopPrank();

test/PaymentManagerMerkle.t.sol

@@ -2,6 +2,8 @@
 pragma solidity ^0.8.20;
 
 import {Test} from "forge-std/Test.sol";
+import "@openzeppelin/contracts/proxy/beacon/UpgradeableBeacon.sol";
+import "@openzeppelin/contracts/proxy/beacon/BeaconProxy.sol";
 import {console2} from "forge-std/console2.sol";
 import {PaymentManager} from "../src/PaymentManager.sol";
 import {ParticipationToken} from "../src/ParticipationToken.sol";
@@ -50,7 +52,9 @@ contract PaymentManagerMerkleTest is Test {
         hats = new MockHats();
 
         // Deploy participation token
-        participationToken = new ParticipationToken();
+        ParticipationToken _ptImpl = new ParticipationToken();
+        UpgradeableBeacon _ptBeacon = new UpgradeableBeacon(address(_ptImpl), address(this));
+        participationToken = ParticipationToken(address(new BeaconProxy(address(_ptBeacon), "")));
 
         uint256[] memory memberHats = new uint256[](1);
         memberHats[0] = memberHatId;
@@ -60,7 +64,9 @@ contract PaymentManagerMerkleTest is Test {
         participationToken.initialize(executor, "Participation Token", "PART", address(hats), memberHats, approverHats);
 
         // Deploy payment manager
-        paymentManager = new PaymentManager();
+        PaymentManager _pmImpl = new PaymentManager();
+        UpgradeableBeacon _pmBeacon = new UpgradeableBeacon(address(_pmImpl), address(this));
+        paymentManager = PaymentManager(payable(address(new BeaconProxy(address(_pmBeacon), ""))));
         paymentManager.initialize(executor, address(participationToken));
 
         // Deploy payment token

test/PoaManager.t.sol

@@ -2,6 +2,8 @@
 pragma solidity ^0.8.20;
 
 import "forge-std/Test.sol";
+import "@openzeppelin/contracts/proxy/beacon/UpgradeableBeacon.sol";
+import "@openzeppelin/contracts/proxy/beacon/BeaconProxy.sol";
 import "../src/PoaManager.sol";
 import "../src/ImplementationRegistry.sol";
 
@@ -16,7 +18,9 @@ contract PoaManagerTest is Test {
     address owner = address(this);
 
     function setUp() public {
-        reg = new ImplementationRegistry();
+        ImplementationRegistry _regImpl = new ImplementationRegistry();
+        UpgradeableBeacon _regBeacon = new UpgradeableBeacon(address(_regImpl), address(this));
+        reg = ImplementationRegistry(address(new BeaconProxy(address(_regBeacon), "")));
         reg.initialize(owner);
         pm = new PoaManager(address(reg));
         reg.transferOwnership(address(pm));

test/QuickJoin.t.sol

@@ -2,6 +2,8 @@
 pragma solidity ^0.8.21;
 
 import "forge-std/Test.sol";
+import "@openzeppelin/contracts/proxy/beacon/UpgradeableBeacon.sol";
+import "@openzeppelin/contracts/proxy/beacon/BeaconProxy.sol";
 import "../src/QuickJoin.sol";
 import "./mocks/MockHats.sol";
 
@@ -56,7 +58,9 @@ contract QuickJoinTest is Test {
         hats = new MockHats();
         registry = new MockRegistry();
         mockExecutor = new MockExecutorHatMinter();
-        qj = new QuickJoin();
+        QuickJoin _qjImpl = new QuickJoin();
+        UpgradeableBeacon _qjBeacon = new UpgradeableBeacon(address(_qjImpl), address(this));
+        qj = QuickJoin(address(new BeaconProxy(address(_qjBeacon), "")));
 
         uint256[] memory memberHats = new uint256[](1);
         memberHats[0] = DEFAULT_HAT_ID;
@@ -76,7 +80,9 @@ contract QuickJoinTest is Test {
     }
 
     function testInitializeZeroAddressReverts() public {
-        QuickJoin tmp = new QuickJoin();
+        QuickJoin _tmpImpl = new QuickJoin();
+        UpgradeableBeacon _tmpBeacon = new UpgradeableBeacon(address(_tmpImpl), address(this));
+        QuickJoin tmp = QuickJoin(address(new BeaconProxy(address(_tmpBeacon), "")));
         uint256[] memory memberHats = new uint256[](1);
         memberHats[0] = DEFAULT_HAT_ID;
         vm.expectRevert(QuickJoin.InvalidAddress.selector);

test/TaskManager.t.sol

@@ -2,6 +2,8 @@
 pragma solidity ^0.8.20;
 
 import "forge-std/Test.sol";
+import "@openzeppelin/contracts/proxy/beacon/UpgradeableBeacon.sol";
+import "@openzeppelin/contracts/proxy/beacon/BeaconProxy.sol";
 import "forge-std/console.sol";
 
 import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
@@ -154,7 +156,9 @@ contract MockToken is Test, IERC20 {
                 setHat(pm1, PM_HAT);
                 setHat(member1, MEMBER_HAT);
 
-                tm = new TaskManager();
+                TaskManager _tmImpl = new TaskManager();
+                UpgradeableBeacon _tmBeacon = new UpgradeableBeacon(address(_tmImpl), address(this));
+                tm = TaskManager(address(new BeaconProxy(address(_tmBeacon), "")));
                 lens = new TaskManagerLens();
                 uint256[] memory creatorHats = _hatArr(CREATOR_HAT);
 
@@ -5440,7 +5444,9 @@ contract MockToken is Test, IERC20 {
                 hats.mintHat(PM_HAT, pm1);
                 hats.mintHat(MEMBER_HAT, member1);
 
-                tm = new TaskManager();
+                TaskManager _tmImpl = new TaskManager();
+                UpgradeableBeacon _tmBeacon = new UpgradeableBeacon(address(_tmImpl), address(this));
+                tm = TaskManager(address(new BeaconProxy(address(_tmBeacon), "")));
                 lens = new TaskManagerLens();
                 uint256[] memory creatorHats = new uint256[](1);
                 creatorHats[0] = CREATOR_HAT;

test/UniversalAccountRegistry.t.sol

@@ -2,14 +2,18 @@
 pragma solidity ^0.8.20;
 
 import "forge-std/Test.sol";
+import "@openzeppelin/contracts/proxy/beacon/UpgradeableBeacon.sol";
+import "@openzeppelin/contracts/proxy/beacon/BeaconProxy.sol";
 import "../src/UniversalAccountRegistry.sol";
 
 contract UARTest is Test {
     UniversalAccountRegistry reg;
     address user = address(1);
 
     function setUp() public {
-        reg = new UniversalAccountRegistry();
+        UniversalAccountRegistry _regImpl = new UniversalAccountRegistry();
+        UpgradeableBeacon _regBeacon = new UpgradeableBeacon(address(_regImpl), address(this));
+        reg = UniversalAccountRegistry(address(new BeaconProxy(address(_regBeacon), "")));
         reg.initialize(address(this));
     }