fn validate_pix_dimension_product(
cfg: &PixGlobalConfig,
) -> Result<(), ValidationError>Expand description
Rejects dimensions whose product is far outside anything that has been measured.
num_ssa_parts and ssa_part_size are range-validated independently, and their ranges permit
16192 × 255 = 4 128 960 commitments, about 8× the profiled operating point of 8192 × 64 =
524 288 (≈49 MiB of peak reconstructor state and ≈1.25 s of commitment ingest per cycle). Nothing
downstream catches that: the product is the per-cycle quota, and the only guard on it is the
peer Exit’s quota_range rejection — which protects the Exit, and arrives after this node has
already generated the cycle.
The ceiling is deliberately on the product rather than on either field, and that is what makes it
stable: re-tuning the split holds the product constant — 4096 × 128 and 8192 × 64 are both
exactly 524 288, which is why the derived quota_range survived that change untouched. Only a
deliberate decision to raise the per-cycle quota needs to revisit this, and such a decision has to
widen the Exit’s quota_range in concert regardless.
It binds less hard than it once did: ssa_part_size was capped at 4096 before the threshold was
narrowed to a byte so it could share the negotiated PixParams word with the surplus, which took
the field-range maximum product down from 126× the profiled point to under 8×. It still binds
over most of the two ranges, which is the intended effect.