Admin controls

The issuer is the immutable brand identity for a Loyalty Token. It signs issue and redeem actions forever, and Loyfin.getLoyalty(issuer, loyaltyId) remains keyed by that issuer. The owner is only the admin for settings.

• New programs have no issuer-operated issuance, redemption, or transfer pause. Their capability getters return true. Expiry, signatures, and nonce checks still apply.
• Shared media, description, royalty bps, and custom royalty receiver are owner-controlled. Media is capped at 512 UTF-8 bytes and description at 1024.
• Admin updates can be direct transactions or owner-signed EIP-712 actions submitted by any wallet holding the valid owner signature.

transferOwnership moves admin control only. It does not move brand identity, issuer signing authority, existing balances, or the factory mapping. renounceOwnership sets the owner to zero and freezes owner-controlled settings.

Brands that need signer rotation should use a multisig or contract wallet as issuer and rotate authorized signers there. Use owner transfer for admin team changes, and use renounce only when the brand is ready to make the current settings permanent.

See Issuer keys and rotation for the effect on pending signatures and the issuer's responsibilities.