persist v50.0.0: DIRECTORY_ABI_VERSION 5→6 — ReachabilityVerdict gains beyond_depth_cap (CC 4.1.1 5-hop default); map it, don't book it as substrate_fault

[emooreatx]

From persist v50.0.0 (CIRISPersist#928, CC 4.1.1). The general delegation walk now defaults to 5 hops (16 stays the ceiling, explicit opt-in). A chain past the effective cap is REPORTED, not shown as an empty walk: ReachabilityVerdict::BeyondDepthCap (pyo3 token beyond_depth_cap), DelegationGraph.depth_outcome, and WithdrawsNotAdmitted.beyond_delegation_depth_cap.

Because BeyondDepthCap is a new variant returned by an EXISTING capsule op (DirectoryOpResult::Reachability), persist bumps DIRECTORY_ABI_VERSION 5 → 6 (persist's capsule policy: a payload-shape change of an existing op bumps; #917's appended ops were growth and did not). Both capsule wire digests move again.

Edge's side: edge.rs:8574 matches _ => substrate_fault on the verdict — a too-deep chain would be booked as a substrate fault. Map beyond_depth_cap as "no transitive trust past the cap" (self_verify-only, CC 4.1.1), not a fault. Also: the withdraws admission gate now walks 5 hops by default; a withdraws resting on a 6–16 hop chain is refused at admission (beyond_delegation_depth_cap=true) — already-admitted withdraws keep their stored rule (no retroactive change). Mixed fleet: a v49 node admits a 6-hop withdraws a v50 node refuses; stated in persist's release note.

Lands with edge's v33.0.0 adopt (CIRISEdge#694/#917 items).

[emooreatx]

Acknowledged; lands with the v33.0.0 adopt (persist v50.0.0). The arm is exactly the defensive one at edge.rs:8574 — _ => { … "ReachabilityVerdict variant unrecognized; refusing as substrate-fault" } — which is correct for a variant edge has never seen and wrong for one persist now names. Plan: an explicit ReachabilityVerdict::BeyondDepthCap => saw_beyond_depth_cap = true arm beside SignerUnreached | NoTrustRoots; the gate's refusal names it (delegation_beyond_depth_cap: no transitive trust past the effective cap — self-verify only, CC 4.1.1 — a verdict about the chain, not the substrate) with its own observability token, distinct from substrate_fault (which stays for SubstrateUnavailable and the truly unknown); a witness that a 6-hop chain under the 5-hop default books beyond_depth_cap and not a fault, and that the explicit 16-hop opt-in still walks. The wildcard stays for the next unknown variant. Mixed-fleet note recorded: a v49 node admits a 6–16-hop withdraws that v50 refuses at admission; stored withdraws keep their rule. DIRECTORY_ABI_VERSION 5→6 moves the wheel floor to >=50,<51 (it was moving anyway for the MAJOR).

[emooreatx]

Shipped in v33.0.0: explicit BeyondDepthCap arm → named non-fault beyond_depth_cap with its own token; witnesses for the default cap and the 16-hop opt-in.