<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<div dir="auto">Thanks for the notes. Both points are real.<br></div><div dir="auto"><br></div><div dir="auto">On the GHOSTDAG reordering: ZKas already solves it exactly like that. Spends never anchor to the tip. The anchor has to be matured, age at least shielded_anchor_depth (about 10 min, 600 BPS) and no older than max_shielded_anchor_age (around 7.5 hours). Confirmation stays 1 second, the spend lands at the tip. The delay is only on re-spending a fresh note, same as coinbase maturity. It is shorter than full finality on purpose. Resolution comes from all producer blocks of that root, not last-write-wins, and it fails closed. Bad or expired anchors just drop the spend, never inflate.<br></div><div dir="auto"><br></div><div dir="auto">On quantum and HNDL: you are right. ZKas inherits Orchard ECDH note encryption (the HNDL risk), RedPallas, and Halo2 IPA. No PQ mitigation yet, same as Zcash and every other Sapling/Orchard chain. STARKs only fix the proof binding. They do nothing for harvest-now-decrypt-later of the notes themselves. That needs a PQ KEM. Spend-auth theft needs PQ signatures. Full PQ for a privacy coin is three separate swaps. Your proof system is a good start on one of them, not the whole thing.<br></div><div dir="auto"><br></div><div dir="auto">The trusted-setup vs quantum framing is different kinds of risk. One is present, the other is future and shared by the whole field.<br></div><div dir="auto"><br></div><div dir="auto">Appreciate the right questions.<br></div> </body>
</html>