feat(pool-v2 PQV2-04): raise note-commitment tree to horizon-safe depth 32

[cloudzombie]

What

Re-derives the STARK spend circuit of the post-quantum shielded pool v2 to raise the note-commitment tree from the depth-20 prototype to the horizon-safe depth 32 (audit PQV2-04 capacity upgrade). TREE_DEPTH == HORIZON_SAFE_TREE_DEPTH == 32; the "depth-20 is a prototype" framing is removed.

DORMANT / no activation change. Signal bit 2 (shielded-v2) stays UNARMED on every network. No Action::ShieldedV2 has ever been accepted on mainnet, so there is no historical v2 proof to preserve. The non-v2 consensus KAT (sov-verify::kat_vectors_are_reproduced_byte_for_byte) is untouched and green.

How the coupling was respected

The AIR's transition constraints are depth-independent (masked per-row); only the trace row-map baked the path length in. Every such constant is now derived symbolically from TREE_DEPTH, with const _: () = assert!(…) guards so no literal can silently assume the old depth:

• INPUT_SEGMENT_ROWS = (3 + TREE_DEPTH + 1)·CYCLE_LENGTH (24 → 36 cycles)
• root_row = input_base + (3 + TREE_DEPTH)·CYCLE_LENGTH − 1
• nf_row = input_base + (4 + TREE_DEPTH)·CYCLE_LENGTH − 1
• TRACE_LENGTH = ACTIVE_ROWS.next_power_of_two() (1024 → 2048)
• prover cycle literals → INPUT_SEGMENT_CYCLES; MAX_V2_NOTES = 2^32−1; frontier/root/exhaustion logic; verify-cost & weight docs; downstream runtime/scan/hash comments.

The canonical context bytes changed by exactly one byte (trace-length exponent 0a → 0b); the trailing constraint-count vint is identical, confirming the deeper path added trace rows, not constraints.

Correctness — the deep path is actually constrained

New negative test spend_circuit_constrains_the_full_32_deep_path: an honest 32-deep spend verifies, and a proof built over a tampered level-28 node (a level that exists only because depth is 32) does not verify under the honest anchor. The full-capacity boundary is proven algebraically (a literal 2^32 fill is infeasible) via with_claimed_size + the size == 2^depth collision argument, plus exhaustive small-depth frontier↔reference equivalence and a many-thousand-append deep-prefix pin at the real depth.

Measured before → after (release, Apple Silicon)

quantity	depth 20	depth 32
serialized proof	98,494 B	107,453 B
verify (median of 11)	~0.9 ms	1.60 ms
prove	—	~68 ms
proven classical soundness	128 bits	128 bits (floor green)

107,453 B stays well under MAX_PROOF_LEN (128 KiB) and MAX_SHIELDED_V2_BUNDLE_BYTES (144 KiB); 1.60 ms keeps ~10× margin under the 16 ms verify-weight budget.

KATs regenerated (each justified in code, all explained by the depth increase)

tree-root digest; v2 state-commitment (empty + one-note); wire publics-header (anchors are deeper roots); canonical proof-context; proof-size pin. Nothing was re-blessed to pass — note commitment, owner tag, and nullifier KATs are unchanged because they do not depend on depth.

Exhaustion economics (flipped prototype → horizon-safe)

Filling the tree now costs ~55.9M XUS (exceeds the entire ~21M supply ~2.6×) and ~127 years of sustained block saturation, so honest-growth and griefing exhaustion are both off the table.

Verification

cargo build --workspace ✓, Station (node/) build ✓, cargo fmt --check ✓, cargo clippy --all-targets -- -D warnings ✓ (chain + Station), tests green for sov-shielded-pq, sov-runtime, sov-types, sov-verify, sov-rpc (v2 e2e), sov-wallet, sov-node, sov-chain.

Updates notes/pq-pool-v2-audit-response.md: PQV2-04 depth upgrade moved from open prerequisite to code-complete, pending the same external circuit audit as the rest of pool v2. Bit 2 stays a named audit-gated item on the arming bar.

🤖 Generated with Claude Code