Both corrections are applied, every check passes, and the fork suite burns at the pinned block over two archive endpoints.

Registry changes (src/Registry.sol)

• PREVIEW_GAS = 600_000 replaces the 200,000 literal as the gas argument of the preview try/catch. Nothing else in the rule moves.
• The constructor reverts ExecutorHasNoCode() for a nonzero executor without code. Zero still means no burn rule. The check reads code size only and never calls the executor.
• Runtime size stayed at 24,495 B before and after (81 B under EIP-170), because the constant has the same width and the code check is init code only. Init code grew from 26,082 to 26,146 B. Composer (23,377 B) and Renderer (21,570 B) are byte-equal and untouched. No factoring was needed.

Known consequence applied: one deployCodeTo line installs the mock executor at the mainnet address in the deploy-script test. No other test broke.

Unit tests (test/BurnRule.t.sol, mock): constructor rejects a bare address and the mainnet constant offline, accepts zero and the mock. The gas fixture now requires 590,000 < entry gas <= 600,000, with the bridge assertions kept. A preview burning 500,000 gas is quoted and bridges; one burning 600,001 skips with code 1 and refunds. The mock's surplus refund now tries a 100,000-gas call first and force-sends only on failure, like the real executor. A claimant re-entering from receive() during that call hits the reentrancy guard. The nonpayable test is replaced by a positive control with zero value, a state snapshot, and the identical call with 1 wei that must revert, for all five paid functions.

Fork tests (test/fork/BurnRule.fork.t.sol): the two zero-preview tests are deleted. New tests use the pinned constants and make the claim the first executor touch in the test. The executor configuration reads moved from setUp into their own test. Results at block 26,202,203:

endpoint	result
eth.drpc.org	6 passed
eth-mainnet.public.blastapi.io	6 passed
rpc.mevblocker.io/fast	4 passed, 2 transient backend reverts; both pass on rerun with identical gas
ethereum-rpc.publicnode.com	no archive state at that block

Checks: forge build clean, forge fmt --check clean, git diff --check clean. forge test with the verifier seed: 164 passed, 0 failed, 17 skipped (the brief said 165 pass today; the tree had 159 before my five additions, matching the step-5 notes). Generator check: 28 artifacts. Python tests: 18 pass.

Docs updated in README, INTEGRATION section 5b, CONCEPT, DISCLOSURE and test/NOTES.md: the measurement with block and date, the burn at the pinned block, the constructor check, exact-fee advice, and the residuals. Every sentence claiming a zero capped preview at the pinned block is gone, and the rule is stated as best effort.

One deviation to note: the background reference says a constructor should not require an address to have code. The brief's correction 2 requires it, so the brief wins, and the deploy-script test installs code at the executor address offline. Nothing was committed or published.

Review complete. The step-1 change is correct on every point I was asked to verify, and I found no blocking defect. Findings and the coverage record are in .imd-findings.json.

What I verified

• Registry diff is minimal. Only the PREVIEW_GAS constant replacing the 200,000 literal, the ExecutorHasNoCode error, its constructor check, and comments. No other literal moved, no behaviour removed. Runtime size measured at 24,495 B, identical to the parent and 81 B under EIP-170.
• Executor code check. A nonzero executor without code reverts at construction, and the zero address still disables the rule. The deploy-script test installs the mock at the mainnet constant.
• Fork tests at block 26,202,203 ran for real. The public endpoint at eth.drpc.org answered archive calls, and all six opt-in tests pass. The cold claim burns the pinned amount for the pinned fee, the executor drains to dust, the exact-fee nonpayable claimant succeeds, the no-fee claim reverts BurnFeeRequired, and the registry's ETH is conserved. Both zero-preview tests are gone. A direct eth_call at that block confirms the measurement: zeros under the old cap, the real quote at 300,000 gas.
• Mock fixture asserts 590,000 to 600,000 entry gas for the preview and 800,000 plus the stipend for the bridge.
• Nonpayability regression has a funded zero-value positive control. Making upgrade() payable in a scratch worktree made it fail with "paid IMD path must reject ETH".
• Checks: build, fmt, offline suite (164 pass, 17 fork skips versus the parent's 159 and 15), generator check (28 artifacts), and the 18 Python unit tests all pass. Only the ten permitted files differ from the parent.
• Docs state PREVIEW_GAS with the block and date, the burn at the pinned block, the exact-fee advice, the residuals, and best-effort wording. The remaining zero-preview sentences in test/NOTES.md are labelled as history.

Hostile executor probing produced two informational notes, neither blocking:

1. A coded executor returning fewer than three words reverts every sponsored claim. This is the residual the objective accepts and the docs state. I reproduced it to name the path.
2. An executor returning about 500 KB of preview data inflates a claim to roughly 3.0M gas but cannot block it.

Reverting previews, previews burning over 600,000 gas, refund-path reentry and ETH-rejecting claimants all behave as documented. Scratch tests and the temporary worktree were removed, so the tree is unchanged apart from the findings file.