Accounts & PDAs

Every account stores its canonical bump (reused, never re-derived). Large accounts (Dispute, Round) are Box<>-wrapped at the call site.

Account	Seeds	Key fields	Notes
Subaccord	["subaccord", creator, risk_type]	creator, staking_token, min_stake, jurors_per_dispute, alpha_bps, review/commit/reveal_window, max_appeals, fee_per_juror, authority, evidence_operator, risk_type, evidence_spec, staker_count, bump	Permissionless. risk_type + evidence_spec immutable. authority == default ⇒ immutable. staker_count = distinct Jurors with amount > 0 (coarse intake gate). ADR-0002, ADR-0005
JurorStake	["stake", subaccord, juror]	subaccord, juror, amount, active_draws, last_change_slot, bump	unstake reverts while active_draws > 0. last_change_slot is the ADR-0008 anchor-slot witness.
Dispute	["dispute", filer, nonce]	subaccord, filer, nonce, num_options, options: [[u8;32]; MAX_OPTIONS], evidence_hash, state, current_round, final_ruling: Option<u8>, fee_paid, committed_vrf: Option<[u8;32]>, bump	committed_vrf set once by callback; draw reads it immutably. final_ruling = None until Final.
Round	["round", dispute, round_idx]	round_idx, juror_count, commit_count, reveal_count, review_end, commit_end, reveal_end, result, jurors: [Pubkey; MAX_JURORS], commits: [[u8;32]; MAX_JURORS], reveals: [u8; MAX_JURORS], bump	#[zero_copy] (AccountLoader). Too large for BPF 4 KB stack under Account<Round>. reveals/result use u8::MAX sentinels (not Option, which is not Pod). Fields reordered + padded for bytemuck::Pod.
Snapshot	["snapshot", dispute, round_idx]	dispute, round_idx, merkle_root, poster, bond, challenge_deadline, status, anchor_slot, total_stake, bump	status ∈ {Posted, Finalized, Voided}. anchor_slot freezes the juror set at post time. total_stake = MST root sum (sortition modulus). ADR-0003, ADR-0008
AppealBond	["bond", dispute, round_idx]	dispute, round_idx, appellant, amount, prior_result, bump	round_idx = round the appeal opens (larger panel). prior_result = winner being appealed. Flip check at settle = final_ruling != prior_result. ADR-0004
PendingUpdate	["update", subaccord, nonce]	subaccord, nonce, proposed: UpdatePayload, proposed_by, execute_after_slot, bump	48h timelock. No-op while Subaccord.authority == default. Closed on execute (rent to caller). ADR-0005
PauseState	["pause"] (singleton)	authority, paused, pending_unpause_after: Option<u64>, bump	pause instant + authority-gated; unpause timelocked. ADR-0007, circuit breaker
Vault	Subaccord-PDA-owned ATA of staking_token	—	SPL TokenAccount; authority = Subaccord PDA. Holds staked capital + all fees/bonds. PDA-signed on every out-transfer.

graph LR
  C[creator] --> SA[Subaccord]
  SA -->|staking_token| V[(vault ATA)]
  SA --> J[JurorStake]
  J -->|amount drawn into| V
  F[filer] --> D[Dispute]
  D --> R[Round]
  D --> S[Snapshot]
  D --> AB[AppealBond]
  SA --> D