purchaseBlocked changed signature with no overload, breaking off-chain callers silently

The L-04 fix is correct — reading the stored terms is exactly what we asked for. It changed the function's signature to do it:

-function purchaseBlocked(address buyer, address holder) external view returns (bool blocked, address blockedBy)
+function purchaseBlocked(address buyer, address holder, uint256 tokenId) external view returns (bool blocked, address blockedBy)

There is no overload at the old selector, and this is a public read that a frontend or a monitor is the natural consumer of.

It fails safe — a caller on the old two-argument selector reverts rather than receiving a wrong answer, which is the right failure mode and why this is not higher. But it fails silently at deploy: nothing in the contract or the deploy flow surfaces that an off-chain consumer has just been broken, and a readiness check that quietly reverts reads the same as infrastructure trouble.

Flagging it because the re-review handoff's per-finding table records #24 as a contract fix without noting the interface change, so a reader reconciling the fix list would not see it.

No contract change needed if your own consumers are updated. Either:

• keep a two-argument overload that answers for the live terms, so old callers keep working and the answer is at worst conservative, or
• note the break explicitly in the release notes for the generation that ships it, and confirm the frontend and any monitor are on the three-argument form before it deploys

Worth a sweep for the same pattern: any other public view whose signature changed across audit-v3..audit-v3-rereview has the same property.

Addressed by the agreed documentation route; no contract change, which is one of the two options this finding offered.

We ran the signature sweep independently and by a different method than the client's — comparing compiled ABI method signatures between the original audit baseline and the frozen generation-d commit, rather than comparing source declarations. It finds exactly five public signatures that changed shape with no overload at the old selector: the two-argument purchaseBlocked and settlementBlocked, and the previous mint, mintBatch and mintSpecial shapes. No further breaking signature was found. Everything else added in the generation is additive. Omitting overloads at the old selectors is consistent with the agreed route, because the retired two-argument views cannot give a token-specific answer reliably: a revert is the better failure than a confidently wrong one.

Release notes covering these changes are carried in the client's re-review addendum, and the signature sweep is recorded there as a standing item at each tag. The frozen code snapshot carries an earlier revision of that addendum; the completed deployment and evidence records are held at a later documentation commit, cited separately in §3.3. The comparison from the frozen code commit to that documentation commit shows no change under src/, script/ or test/, so the two references describe the same reviewed code.

The client's statement that its own application and edge functions are migrated to the three-argument forms is a client assertion; it is outside this repository and was not independently verified.

Final disposition: Addressed · docs. Verified at generation-d, commit bcf18bb2926589bb8538fa8c322eabc871ff2801. This finding was assessed in the generation-d mitigation review. The report-wide scope and evidence limitations remain applicable; see the final report overview.