Function privacy

K verifies the method proof under a witnessed VK whose hash it opens under methods_vk_root of a program leaf it opens under program_root. Program, template, method, and instance are witnesses. Because fragment statements have one fixed shape with dummies in unused slots (§5.1), the chain cannot tell an escrow release from a payment. This is the wrapper's vk_root trick applied one layer down. An optional disclose(program preimage) off-chain flow serves auditors, as for policies.