# E11. Archive lineage and configuration rotation

## Historical material

The ECHOES delivery-history record describes four archive revisions in a repository created in March 2026. The preserved lure structure includes the same decoy images and an encoding scheme, with changes to retrieval configuration and later staging behavior. No archive was launched to prepare this report. [S1]

## Revision sequence

- 5 March 2026, 06:17 UTC, commit `03f1795d`: the earliest recorded retrieval configuration and task tag DDD.
- 17 March, 05:14 UTC, commit `ded13153`: a different account/repository destination, retaining DDD and changing scheduled-task timing.
- 25 March, 03:54 UTC, commit `b209f365`: another repository destination, task tag WORD and an added VBS persistence layer.
- 25 March, 13:29 UTC, commit `4b6ea6b2`: a further destination change and a new access token; the staging is otherwise unchanged from `b209f365`.

Commit identifiers and dates are reported by the historical note; the retained archives support the content comparison, but the original remote history is not retained. The history supports continuity of the staging kit with changing retrieval locations. The later persistence addition also means the revisions should not be described as differing only in configuration. Embedded access tokens and archive-password values are not reproduced. [S1]

## Missing final stage

The referenced final PowerShell payloads were unavailable through the unauthenticated retrieval routes examined. Recovered operator credentials were not used to obtain them. The archive lineage can therefore establish staging and configuration relationships, but cannot supply capabilities for the missing final payload. It should not be assumed to be the same payload as the VSIX or ClickFix branches.

## Account-status limitations

The record discusses an account returning 404 while its name remained unavailable for registration. That pattern supported a suspension hypothesis, with acknowledged alternatives. It is not a provider confirmation and does not establish the current account state. Nearby numeric account identifiers were also examined without a discriminating sibling-account pattern. Registration adjacency alone is not evidence of coordinated account creation.

## Assessment

The strongest evidence is the preserved revision sequence and repeated staging structure. Claims about who controlled an account, why it became unavailable, or what the unrecovered payload would do require additional evidence. E14 separately covers the poster's recorded provenance metadata.