Implemented (a)–(h) and re-reviewed; changes and evidence are in test/NOTES.md.

• Offline build/tests pass: 90 passed, 11 RPC-dependent skips.
• Formatting and template checks pass.
• Registry runtime: 23,027 bytes, leaving 1,549 bytes headroom.
• Existing ABIs preserved; no immutable references.
• Repaired one existing invariant-harness overflow.

Nothing deployed.

I've applied changes (i) to (q) and recorded each one in test/NOTES.md. forge build, forge test with no network (101 passed, 0 failed; the 11 fork tests skip), forge fmt --check and python3 tools/gen_template.py --check all pass. Nothing under src/ changed, and nothing was deployed or committed.

Cold onResult gas. I prepared the request and the signature, then called vm.cool on the registry, then delivered through the mock Intake's real 200,000-gas call. Each test checks the callback was delivered and logs the gas:

path	gas now	independent reviewer, before the contract changes
first community verification, with a card	133,356	135,193
64-address shared fact, catalog id 1201	164,087	170,779
64-address shared fact, community spec (head 32, the maximum)	170,445	177,134

The mock now records the gas used around its own call, including the cold access to the registry.

Tests

• (i) Invariants: the which-modulo fix was already in the tree from the previous step. replayConsumed is now one of the targeted selectors, and a new unit test confirms a replay reaches the registry and changes nothing. All five extended campaigns pass with fail_on_revert on.
• (k) Reentrancy: the attacking token now holds IMD and has approved the registry. I wired in an Intake that sells in that token, so only the guard can refuse a re-entered call. The test asserts the exact ReentrancyGuardReentrantCall() error for five functions: upgrade, sponsor, registerSpec, requestSharedFact and mintCard. As a positive control, the same payloads sent from outside the guard succeed and take effect.
• (k) High-s: every bad signature, including the high-s twin, is now built from the exact envelope it is delivered with. Plain ecrecover still recovers the attester from the twin, and the low-s original then verifies.
• New tests in test/ReReview.t.sol:
  • (a) oversized signatures on community requests;
  • (b) the lowest ordinal wins;
  • (c) community attributes only for verified specs;
  • (e) an unused fixedVal is refused and an empty filter is never written into the question;
  • (f) a Curator whose isSettled writes storage cannot be deployed against;
  • (n) the same signed evidence satisfies a later request with the identical question;
  • (p) spec id 65534 registers and the next one reverts.

Docs

• (l) README "How to verify a card" now derives topic0 from the canonical event signature and the topic positions from the indexed-argument order of the stored item.
• (m) README says how to run the fork tests with CHAINTRAITS_FORK_RPC, and the "not delivered" text is gone.
• (n), (o) CONCEPT.md invariants 4 and 7 are updated, and README now says questionHashOf takes the canonical document, not the body.
• (p) CATALOG.md section 5 states the 55,534-spec limit.
• (q) CONCEPT.md section 6 and INTEGRATION.md section 1 now describe three contracts and seven constructor arguments. CATALOG.md section 8 carries the open question about signatures with agreed below quorum.

One inconsistency is left: INTEGRATION.md section 4, check 7 still says questionHashOf(body). It wasn't in the list of changes, so I didn't touch it and noted it in test/NOTES.md; it's a one-word fix if you want it.

This round was a local re-review, not an independent audit.

Review complete. The findings are in .imd-findings.json at the repository root, the scratch probe is removed, and no source, test, or configuration file was changed.

Outcome: no high or medium defect. Every listed change does what its step says, and I found no regression in the areas named by the assignment.

What I verified, change by change:

• (a) Callback bounds and precedence. Registry._check returns reason 2 for a signature not exactly 65 bytes, then reason 9 for an answer over 2112 bytes or not exactly 32 bytes for a non-T3 pending kind, before any hash or copy. The order chainId, signer, type, panel, window, expiry, questionHash, decode, rule matches INTEGRATION.md section 4 and CATALOG.md section 4. The 262,144-byte envelopes finish as a Missed under the mock Intake's real 200,000-gas call, with cold storage.
• (b) Ordinal. cardOf keeps the first ascending family-11 id and the highest id for tier families. Covered by a fuzz over all 32 ordinal subsets acquired in descending order.
• (c), (d) Attributes and metadata keys. One standard attribute per shown community id with the escaped spec name, community_count with the full count, and minPanelSize and minQuorum keys. Generator, goldens and Solidity agree byte for byte.
• (e) Spec guards. Every CATALOG.md section 5 guard is enforced, including the new fixedVal rule. A scratch probe composed the longest legal spec of each kind, with a 78-digit fixedVal and threshold, without hitting the 1000 or 512 character limits. The largest body was 2,041 bytes.
• (f) Settled check. The constructor reads isSettled through the view interface, so a writing, false, reverting or no-code Curator fails deployment. No immutables, and two deployments produce identical runtime code.
• (g) Move into Composer. hasTrait(address,uint16) and traitsOf(address) keep their ABI on the registry. The moved functions are view-only, reached by static call, and never run inside onResult.
• (i) to (q). The handler fix, cold-gas tests, re-entrancy and high-s tests, and the documentation edits match the code, with one exception reported below.

Findings, ranked:

1. Low, INTEGRATION.md line 223. Check 7 still says the golden test asserts questionHashOf(body). The test and the (o) edits to README and CONCEPT use the canonical document. Hashing the body gives a value the plane never signs.
2. Info, CATALOG.md line 152. The guard table says target is "unused for T5", but validateSpec refuses any nonzero T5 target, as the struct comments elsewhere say.
3. Info, Registry.sol line 375. upgrade([1201]) reverts NotAnOracleTrait(1201) while a community T3 id reverts NotASharedFact. Both revert before any IMD moves.

The coverage record answers all 16 entry points, 15 as holding and upgrade tied to the info finding, plus three invariant rows for the settled check, the Composer ABI, and the card rendering.