E4 update: public financial and recovery-address evidence, 2026-10-31 05:45 pass

Two actual Ethereum transactions recover the known E4 signing key. At04:39:35UTC nonce0 sent0.1ETH to3dce0a29139a851da1dfca56af8e8a6440b4d952; nonce1 at04:44:47 sent0ETH and a short statement referring to the first transaction. The first input is1201 opaque bytes, the second81 public bytes. Complete signed financial inputs permit exact offline reconstruction; their contents remain uninterpreted and are never instructions or accepted assertions. The two gas fees total212532775789400wei;0.5ETH less payment and gas equals0.3997874672242106ETH at fixed head26310742. No Car–drainer causal/control/private-payment/coordination link is established.

The exact recipient address independently matches Security Alliance's published Polymarket Asset Recovery Address on Polygon. The2024-10-19 onchain registration's typed transaction, ABI, event and header bind protocol name, chainID137, recipient and agreement URI. The original-registry current pointer equals that registration's newDetails pointer; broad update-history queries failed, so this does not prove no intervening update or global current legal applicability. Full agreement body remains unavailable. No negotiated return, bounty eligibility, compliance, human identity or Ethereum custody is established by this role match.

The recipient-crosschain component replays seven independently pinned chain states and current Polygon Safe configuration/runtime. The deployment component separately replays the original Safe creation/initializer and its stated CREATE2/availability checks. Current Polygon3of7 authority must not be projected onto undeployed Ethereum configuration. Empty Ethereum runtime and transaction nonce0 do not establish EOA status, possession of a private key, controllability, irrecoverability or absence of prior incoming messages.

The independent correspondence audit finds three indexed E4 ordinary transactions and two for the recipient, without index continuation: prior3f7010.5ETH funding with empty calldata and these two new messages. A successful zero-inclusive RPC trace window26301932..26310742 returns precisely those three calls, including the zero-value message. No earlier request text is recovered in that stated index/window. Genesis trace probes failed and index completeness remains a dependency; offchain, other-chain and unobserved earlier contacts remain outside this result. The word responded does not authenticate a prior request or negotiation.

Actual E4/recipient addresses and the classified recovery Safe/configuration inputs have no exact match in the bounded comparison sets. Selected26 is only a subset; mixed117 includes observed financial associates, keys, computed formats, public services and human-control leads with distinct roles. Neither inventory is an exhaustive ownership network. A public recovery endpoint is not attacker-owned merely because it receives a payment. Different keys do not prove different human operators.

Run from this extracted ZIP root:
  PYTHONDONTWRITEBYTECODE=1 python3 verify_package.py

The stdlib wrapper validates every selected byte and JSON/gzip/Python syntax; runs the attacker full-state/signature/partition/tamper bundle, root independent E4 signature replay, recipient state/Safe replay, independent correspondence/registry typed-transaction replay and deployment replay. It disables sockets and DNS in itself and all Python children. The attacker controls reject a rehashed actual-signature change and false recipient balance. An additional recompressed financial-registry chain137 mutation is rejected by full signed transaction hashing rather than only a package checksum. All temporary control files are removed, and selected evidence bytes remain unchanged.

Financial replays establish retained-byte, public-key, provider-state and header/receipt consistency within their stated scopes. They are not standalone consensus/receipt-root proofs, human identity, voluntary consent, message truth, private-session authentication, deployment access or exploit causation. Curated disclosure/profile/source metadata consistency does not authenticate omitted full bodies. Full social, profile, article, HTML, agreement/PDF and runtime/source bodies stay local. Source-index absolute paths or unselected filenames may intentionally point to excluded local evidence; this is not an archive-complete pack. No signing, broadcast, contact, embedded-link execution or private access is required.
