cascade

    );     // Check if 30 days have passed since employee's last activity    let employee_inactive_duration = clock.unix_timestamp - stream.employee_last_activity_at;    let thirty_days: i64 = 30 * 24 * 60 * 60;     require!(        employee_inactive_duration >= thirty_days,        ErrorCode::EmployeeStillActive    );     let remaining_balance = stream        .total_deposited        .checked_sub(stream.withdrawn_amount)        .ok_or(ErrorCode::InsufficientBalance)?;     // Transfer remaining balance back to employer    let employer_key = stream.employer.key();    let employee_key = stream.employee.key();    let seeds = &[        b"stream",        employer_key.as_ref(),        employee_key.as_ref(),        &[stream.bump],

1. Line 16 let employee_inactive_duration = clock.unix_timestamp - stream.employee_last_activity_at;: Reads on-chain time from the Clock sysvar.
2. Line 19 require!(: An explicit validation that aborts the instruction with an error.
3. Line 26 .checked_sub(stream.withdrawn_amount): Uses checked arithmetic so overflow fails instead of wrapping.
4. Line 32 let seeds = &[: Declares the PDA seeds. Anchor re-derives the address and rejects the account if it doesn't match.
5. Line 36 &[stream.bump],: Uses the bump seed, the extra byte that pushes the derived address off the ed25519 curve.

    // Transfer tokens from vault to employee using PDA signer    let employer_key = stream.employer.key();    let employee_key = stream.employee.key();    let seeds = &[        b"stream",        employer_key.as_ref(),        employee_key.as_ref(),        &[stream.bump],    ];    let signer = &[&seeds[..]];     let cpi_accounts = Transfer {        from: ctx.accounts.vault.to_account_info(),        to: ctx.accounts.employee_token_account.to_account_info(),        authority: stream.to_account_info(),    };    let cpi_program = ctx.accounts.token_program.to_account_info();    let cpi_ctx = CpiContext::new(cpi_program, cpi_accounts).with_signer(signer);    token::transfer(cpi_ctx, amount)?;     // Update stream state    stream.withdrawn_amount = stream        .withdrawn_amount        .checked_add(amount)

1. Line 40 let seeds = &[: Declares the PDA seeds. Anchor re-derives the address and rejects the account if it doesn't match.
2. Line 44 &[stream.bump],: Uses the bump seed, the extra byte that pushes the derived address off the ed25519 curve.
3. Line 54 let cpi_ctx = CpiContext::new(cpi_program, cpi_accounts).with_signer(signer);: Makes a cross-program invocation into another program.
4. Line 55 token::transfer(cpi_ctx, amount)?;: An SPL token transfer through the Token Program.
5. Line 60 .checked_add(amount): Uses checked arithmetic so overflow fails instead of wrapping.

    Ok(())} #[derive(Accounts)]pub struct CloseStream<'info> {    #[account(mut)]    pub employer: Signer<'info>,     #[account(        mut,        close = employer,        seeds = [b"stream", employer.key().as_ref(), stream.employee.as_ref()],        bump = stream.bump,        has_one = employer    )]    pub stream: Account<'info, PaymentStream>,     #[account(        mut,        close = employer,        seeds = [b"vault", stream.key().as_ref()],        bump,    )]    pub vault: Account<'info, TokenAccount>,

1. Line 19 pub employer: Signer<'info>,: Requires this account to have signed the transaction.
2. Line 23 close = employer,: Closes the account at the end of the instruction and refunds its lamports.
3. Line 24 seeds = [b"stream", employer.key().as_ref(), stream.employee.as_ref()],: Declares the PDA seeds. Anchor re-derives the address and rejects the account if it doesn't match.
4. Line 25 bump = stream.bump,: Uses the bump seed, the extra byte that pushes the derived address off the ed25519 curve.
5. Line 26 has_one = employer: Checks that a stored pubkey field matches the passed account.

    stream.total_deposited = stream        .total_deposited        .checked_add(additional_amount)        .ok_or(ErrorCode::MathOverflow)?;     Ok(())} #[derive(Accounts)]pub struct TopUpStream<'info> {    #[account(mut)]    pub employer: Signer<'info>,     #[account(        mut,        seeds = [b"stream", employer.key().as_ref(), stream.employee.as_ref()],        bump = stream.bump,        has_one = vault    )]    pub stream: Account<'info, PaymentStream>,     #[account(mut)]    pub vault: Account<'info, TokenAccount>,

1. Line 27 .checked_add(additional_amount): Uses checked arithmetic so overflow fails instead of wrapping.
2. Line 36 pub employer: Signer<'info>,: Requires this account to have signed the transaction.
3. Line 40 seeds = [b"stream", employer.key().as_ref(), stream.employee.as_ref()],: Declares the PDA seeds. Anchor re-derives the address and rejects the account if it doesn't match.
4. Line 41 bump = stream.bump,: Uses the bump seed, the extra byte that pushes the derived address off the ed25519 curve.
5. Line 42 has_one = vault: Checks that a stored pubkey field matches the passed account.