akd

Fixes an append-only bypass in the AKD auditor. Problem The auditor verifies an epoch transition by inserting a proof's , then its nodes, checking each against the start/end root hash. This relies on re-inserting an unchanged node being a no-op. But silently drops any node whose label is not strictly beneath the pivot, so an unchanged interior node whose label is a strict prefix of an inserted leaf has its committed value discarded. A malicious server can exploit this to rewrite an existing label's value while still producing a valid append-only proof, defeating the auditor's append-only guarantee. Fix Enforce that no committed value is dropped during an batch insert, turning the silent drop into a verification error. The check is count-based (every input element must land in the left or right subtree), so it catches a drop regardless of label shape, with a narrow carve-out for the single element that legitimately becomes a leaf. Scoped to ; the directory publish path inserts full-length leaves only and is unaffected. Tests (auditor.rs) — reproduces the bypass end-to-end through : both membership proofs verify against their respective roots with , and the transition must now be rejected. (append_only_zks.rs) — exercises the guard directly: strict-prefix collision, duplicate-label collision, plus a positive control confirming disjoint leaves still insert cleanly. Both verified to fail without the guard and pass with it, under both and configurations. Full lib suite green (106 tests). Reported by @sanjit-bhat

As titled