spec: hide the next_pubkey rotation edge behind a per-transition commitment

[TaprootFreak]

Problem

PR #85 bound next_pubkey into the signed SpendRecord message so the account's single transition signature authorises the key rotation on every transition (custody — closes the operational-bundle-node account takeover via an unbatched receive).

But it placed the raw next_pubkey = Pkᵢ₊₁ in the clear in the public, plaintext BatchBundle, next to each record's public_key = Pkᵢ. Since next_pubkey(txn i) == public_key(txn i+1), any observer fetching the public bundles can chain an account's consecutive SpendRecords by the rotation edge — a public, cross-transition account linkage of the transaction graph.

This contradicts the unlinkability the spec itself states against a BatchBundle scanner:

• §2.3.2: "the publisher still cannot link this SpendRecord to the account's prior records"
• §3.5 metadata: "the transaction graph … remain invisible to a chain-only observer"
• §5.5 public mode: "per-spender activity remains hidden behind the bundle boundary"
• Requirement 2 (no linking two on-chain events to the same account)

It is a regression: before #85, message = inr ‖ ocr (64 B) and next_pubkey was witness-only, so the rotation edge was never published.

Fix

Make the third message segment a hiding commitment rather than the raw key:

next_pubkey_commit = H("zkCoins/v1/NextPubkeyCommit" ‖ next_pubkey ‖ npk_rand) (SHA-256, wallet-native, no Poseidon; npk_rand = fresh secret 32-byte blind the wallet draws per transition).

• message = inr ‖ ocr ‖ next_pubkey_commit — still 96 bytes; all SpendRecord sizes unchanged (193 + 32·|nf|, 225 single-input, 193 mint).
• §2.1 clause 2 additionally checks the opening next_pubkey_commit == H(tag ‖ w.next_pubkey ‖ w.npk_rand) against the same w.next_pubkey clause 7 folds into the account state. Custody is preserved exactly as tightly (SHA-256 collision resistance: a party without skᵢ can neither sign a different commitment nor open the given one to another key).
• The published value is hiding: a scanner reading the next record's public_key = Pkᵢ₊₁ cannot recompute the commitment without the secret npk_rand, so the rotation edge no longer chains records — the §2.3.2/§3.5/§5.5 claims become true again.
• npk_rand is a circuit witness only, carried wallet→node in the /sign body; never in a SpendRecord, BatchBundle, CoinProof, or to a publisher.

Single file (docs/specification.md). Test-vector blind npk_rand@0 = H("zkCoins/v1/test-vector/npk_rand") pinned (verified SHA-256); next_pubkey_commit@0 left <REGEN>.

[TaprootFreak]

One review pass (soundness + consistency lenses) with zero findings. The soundness lens confirmed custody is preserved exactly as tightly as the raw-key signature — a party without skᵢ can neither sign a different commitment nor open the given one to another key (SHA-256 collision/second-preimage resistance), and the clause-2 opening ties the committed value to the same w.next_pubkey clause 7 folds into the account state — while the privacy regression is genuinely closed: the raw next_pubkey appears in no public object, npk_rand is a 256-bit secret witness never placed in any SpendRecord/BatchBundle/CoinProof/publisher body, so a bundle scanner can no longer chain records by the rotation edge. The consistency lens independently recomputed the pinned npk_rand@0 SHA-256, confirmed message stays 96 bytes with all record sizes unchanged, and verified the previously contradictory §2.3.2/§3.5/§5.5 unlinkability statements are now true.