The reviewed proofs establish a private financial network around Car. They do not establish a private payment, common signing authority, malicious-source control or authenticated coordination link to the confirmed drainer controllers.

A concrete comparison-input gap was found. The later CarUnion112 set omits five observed financial/controller endpoints: E044's signing key and its two deployed wallets, plus the actually Car-funded5mTraderYes wallet and its recovered7df8 signing key. The expanded117 set preserves all112 previous inputs and adds those five. It remains a mixed-role comparison input, not117 Car-owned wallets. Earlier E044-specific checks against the ten known attacker endpoints were already completed; the new test is the expanded input against newly reconstructed attacker authorities/counterparties.

Financial association and Car human control are separate. W6,3e837,CarComboCup,6d132,5mTraderYes and other named accounts have specific financial proofs while common human ownership or exploit purpose remains unproved. The selected26 observed-profile/private-associate subset is not the full verified financial network. Public services, computed-only formats and other human-control leads are explicitly separated.

DIRECT-LINK-HYPOTHESES-AND-GAPS.json states eleven supported, narrowly contradicted or unresolved hypotheses and the exact evidence each still needs. It records the completed proof scopes; separately assigned new74e9 and complete July-counterparty work are not prematurely counted as results here.

The remaining useful public tests target actual new private counterparties, actual signing authority or exact malicious artifact/deployment control. A shared exchange wallet, relayer, generic implementation, ordinary market fill, deleted status or unrelated trading dispute does not supply that missing edge.

If those public tests remain negative, distinguishing voluntary use of Car's existing signer from a compromised client requires authenticated session/client/order-submission or vendor-control records tied to the executed order/message hashes and exact malicious bytes. This is an evidentiary requirement, not permission to access private systems, research private identities or contact third parties. A new public signed or primary control record could still satisfy it.

This is a source-scope and requirements audit, not a fresh all-chain/history scan or a replay of every earlier signature. Source hashes identify the retained inputs reviewed; they do not independently authenticate omitted source bodies, human identity, exclusive key custody, consent, intent or chain consensus. No site edits, signing, broadcasting, outreach or private identity research was performed.
