afterlife

 pub fn handler(ctx: Context<ExecuteDistribution>) -> Result<()> {    let vault = &ctx.accounts.vault_config;     require!(vault.is_active, VigError::VaultInactive);     let now = Clock::get()?.unix_timestamp;    require!(vault.is_expired(now), VigError::TimerNotExpired);     let total_amount = ctx.accounts.owner_token_account.amount;    require!(total_amount > 0, VigError::ZeroBalance);     let owner_key = vault.owner;    let bump = vault.bump;    let token_mint_key = ctx.accounts.token_mint.key();    let decimals = ctx.accounts.token_mint.decimals;     // vault_config PDA is the approved SPL delegate — sign with its seeds    let seeds: &[&[u8]] = &[b"vigil", owner_key.as_ref(), &[bump]];     token::transfer_checked(        CpiContext::new_with_signer(            ctx.accounts.token_program.key(),            TransferChecked {

1. Line 53 require!(vault.is_active, VigError::VaultInactive);: An explicit validation that aborts the instruction with an error.
2. Line 55 let now = Clock::get()?.unix_timestamp;: Reads on-chain time from the Clock sysvar.
3. Line 62 let bump = vault.bump;: Uses the bump seed, the extra byte that pushes the derived address off the ed25519 curve.
4. Line 69 token::transfer_checked(: A checked token transfer, which also verifies the mint and decimals.
5. Line 69 token::transfer_checked(: An SPL token transfer through the Token Program.
6. Line 70 CpiContext::new_with_signer(: Makes a CPI signed by a PDA. The signer seeds prove the program controls that address.

    let amount = executed_total        .checked_mul(share_bps as u64)        .ok_or(VigError::ArithmeticOverflow)?        .checked_div(10_000)        .ok_or(VigError::ArithmeticOverflow)?;     require!(amount > 0, VigError::ZeroBalance);     let vault_config_key = ctx.accounts.vault_config.key();    let vault_auth_bump = ctx.bumps.vault_authority;    let vault_auth_seeds: &[&[u8]] = &[b"vault_auth", vault_config_key.as_ref(), &[vault_auth_bump]];     token::transfer_checked(        CpiContext::new_with_signer(            ctx.accounts.token_program.key(),            TransferChecked {                from: ctx.accounts.vault_token_account.to_account_info(),                mint: ctx.accounts.token_mint.to_account_info(),                to: ctx.accounts.heir_token_account.to_account_info(),                authority: ctx.accounts.vault_authority.to_account_info(),            },            &[vault_auth_seeds],        ),        amount,

1. Line 86 .checked_mul(share_bps as u64): Uses checked arithmetic so overflow fails instead of wrapping.
2. Line 91 require!(amount > 0, VigError::ZeroBalance);: An explicit validation that aborts the instruction with an error.
3. Line 97 token::transfer_checked(: A checked token transfer, which also verifies the mint and decimals.
4. Line 97 token::transfer_checked(: An SPL token transfer through the Token Program.
5. Line 98 CpiContext::new_with_signer(: Makes a CPI signed by a PDA. The signer seeds prove the program controls that address.

use anchor_lang::prelude::*;use crate::state::VaultConfig;use crate::errors::VigError; #[derive(Accounts)]pub struct ForceExpire<'info> {    #[account(        mut,        seeds = [b"vigil", owner.key().as_ref()],        bump = vault_config.bump,        has_one = owner @ VigError::Unauthorized,    )]    pub vault_config: Account<'info, VaultConfig>,     #[account(mut)]    pub owner: Signer<'info>,} // Backdates last_checkin so the vault appears expired — for demos and testing onlypub fn handler(ctx: Context<ForceExpire>) -> Result<()> {    let vault = &mut ctx.accounts.vault_config;    require!(vault.is_active, VigError::VaultInactive);    let interval_secs = vault.interval_days as i64 * 86_400;    let grace_secs = vault.grace_period_days as i64 * 86_400;

1. Line 9 seeds = [b"vigil", owner.key().as_ref()],: Declares the PDA seeds. Anchor re-derives the address and rejects the account if it doesn't match.
2. Line 10 bump = vault_config.bump,: Uses the bump seed, the extra byte that pushes the derived address off the ed25519 curve.
3. Line 11 has_one = owner @ VigError::Unauthorized,: Checks that a stored pubkey field matches the passed account.
4. Line 16 pub owner: Signer<'info>,: Requires this account to have signed the transaction.
5. Line 22 require!(vault.is_active, VigError::VaultInactive);: An explicit validation that aborts the instruction with an error.

use anchor_lang::prelude::*;use crate::state::VaultConfig;use crate::errors::VigError; #[derive(Accounts)]pub struct Cancel<'info> {    #[account(        mut,        seeds = [b"vigil", owner.key().as_ref()],        bump = vault_config.bump,        has_one = owner @ VigError::Unauthorized,        close = owner    )]    pub vault_config: Account<'info, VaultConfig>,     #[account(mut)]    pub owner: Signer<'info>,     pub system_program: Program<'info, System>,} pub fn handler(_ctx: Context<Cancel>) -> Result<()> {    // `close = owner` returns rent to owner regardless of active state    Ok(())

1. Line 9 seeds = [b"vigil", owner.key().as_ref()],: Declares the PDA seeds. Anchor re-derives the address and rejects the account if it doesn't match.
2. Line 10 bump = vault_config.bump,: Uses the bump seed, the extra byte that pushes the derived address off the ed25519 curve.
3. Line 11 has_one = owner @ VigError::Unauthorized,: Checks that a stored pubkey field matches the passed account.
4. Line 12 close = owner: Closes the account at the end of the instruction and refunds its lamports.
5. Line 17 pub owner: Signer<'info>,: Requires this account to have signed the transaction.