bugfix: Fixed off-by one boundary in non-allowed qm31 libfunc. - #10009

Summary

Replaces the use of u128::MAX with u128_bound() when computing the fixer constant in build_qm31_unpack. This corrects an off-by-one error: u128::MAX is 2^128 - 1, but the intended bound is 2^128 (i.e., u128_bound()), shifting the fixer value by 1 and producing the correct range-check constant 340282366920938463463374607363048734720 instead of 340282366920938463463374607363048734719.

Type of change

Please check one:

• Bug fix (fixes incorrect behavior)
• New feature
• Performance improvement
• Documentation change with concrete technical impact
• Style, wording, formatting, or typo-only change

Why is this change needed?

The fixer constant in build_qm31_unpack was computed using u128::MAX (2^128 - 1) instead of 2^128. The intent is to validate that sum lies within [0, 2^36) by checking that sum + fixer fits in a u128 range check cell, where fixer = 2^128 - PART_UPPER_BOUND. Using u128::MAX instead of 2^128 shifts the fixer by 1, making the range check boundary incorrect.

What was the behavior or documentation before?

The fixer was u128::MAX - PART_UPPER_BOUND, producing a constant of 340282366920938463463374607363048734719.

What is the behavior or documentation after?

The fixer is u128_bound() - PART_UPPER_BOUND, producing the correct constant of 340282366920938463463374607363048734720, properly enforcing that sum is within [0, 2^36).

Related issue or discussion (if any)

N/A

Additional context

The e2e test data for the qm31 libfunc is updated to reflect the corrected constant value.