[KSlashh]

Audit items M9 and M15. Open against dev.

The relayer's Goat calls handled a revert in two opposite ways:

• postGraphData and the peg-out settlement calls (proceedWithdraw, finishWithdraw*) treated any revert as a permanent rejection. Their job ids are stable, so they never ran again. A revert from a lagging or load-balanced Goat RPC ended the job, and only another relayer or a human could finish the call (M9).
• postPeginData retried every revert forever, so the PostPeginDataRejected alert never fired (M15).

Now a revert gets 5 consecutive runs, a minute apart. Every one of these jobs reads the Goat state before calling (graph already posted, withdraw status, pegin status), so if another relayer made the call meanwhile, the next run ends as done. If the call still reverts after 5 runs, the existing rejection path takes over and alerts: post_graph_data_rejected, pegout_action_rejected, or PostPeginDataRejected. The count is kept in the job's last error. Any other failure in between, such as waiting for SPV, starts the count again.

A rejected postGraphData now fails its job instead of finishing it with a note, so post_graph_data_rejected fires. That alert only fired for a failed job, so it was never raised before.

The client's own checks before postPeginData ("not a pending pegin request", amount mismatch, not a committee member) stay final at once.

Review notes

• Applies to every graph job, since all of them go through the same runner. Only the relayer's calls above write to Goat.
• 5 runs × 60 s is meant to cover RPC lag. A revert that lasts longer is treated as the contract's answer.

Tests: a revert is retried for 4 consecutive runs and then left to the rejection path; another failure in between starts the count again; other errors are untouched. The runner arms themselves are not covered: the graph test harness scripts its own runners. Node tests, workspace clippy with -D warnings and fmt pass.

The test coverage and validation notes above are from the zkm PR notes. Branch scope and diff formatting were checked locally; builds and tests were not rerun during publication.