Something after the declaration is refused whole

A JSON decoder reads one value and stops, so a file holding a declaration and
then anything else parsed as the declaration and the rest was never looked at.
The machine applies something, reports success, and what it applied is not what
the file says — the same fault this host refuses everywhere else, in its
quietest form.

Not hypothetical. A test harness had been appending a line to the substrate
bundle by accident; every apply kept working and nothing said so for as long as
it was wrong. That is how the bug was found, and it is the argument for the
refusal: a file with something after it may be a truncated rewrite or two
declarations run together, and applying the first would be applying something
nobody wrote.

Trailing whitespace is not "something after it".

internal/declaration/declaration_test.go

@@ -313,3 +313,34 @@ func TestSomethingInsideAValueIsNotAComment(t *testing.T) {
 		t.Fatalf("a value was mangled: %q", file.Content)
 	}
 }
+
+// A declaration followed by anything at all is refused whole.
+//
+// A JSON decoder reads one value and stops, so a file holding a declaration and then a stray line
+// parses as the declaration and the rest is never looked at. The machine applies something,
+// reports success, and what it applied is not what the file says.
+//
+// Not hypothetical: a test harness appended a line to the substrate bundle by accident, every
+// apply kept working, and nothing said so for the entire time it was wrong.
+func TestSomethingAfterTheDeclarationIsRefused(t *testing.T) {
+	good := `{"declaration":1,"resources":[{"id":"a","type":"file","path":"/tmp/a",` +
+		`"content":"x","mode":"0644"}]}`
+	if _, err := ParseFileTrusted([]byte(good)); err != nil {
+		t.Fatalf("an ordinary declaration was refused: %v", err)
+	}
+	for _, after := range []string{
+		"MESHBUNDLE 2>&1; echo \"__exit=$?\"",
+		good,
+		"garbage",
+	} {
+		_, err := ParseFileTrusted([]byte(good + "\n" + after))
+		if err == nil {
+			t.Fatalf("a file with %q after the declaration was accepted", after)
+		}
+	}
+	// Trailing whitespace is not "something after it", and refusing it would make every file
+	// written by an editor unusable.
+	if _, err := ParseFileTrusted([]byte(good + "\n\n  \n")); err != nil {
+		t.Fatalf("a declaration with a trailing newline was refused: %v", err)
+	}
+}