Total Constraints ≈
  (Hash Ops × 1,000) +
  (SHA256 Ops × 25,000) +
  (Comparisons × 254) +
  (Merkle Depth × 1,000) +
  (Loop Iterations × Body Cost)

// High-cost operations
persistentHash()      // ~1,000 constraints
persistentCommit()    // ~1,000 constraints
sha256()              // ~25,000 constraints ❌ Avoid
ecMul()               // ~5,000-10,000 constraints

// Medium-cost operations
if x < y { }          // ~254 constraints (bit decomposition)
for i in 0..N { }     // Multiplies inner constraints by N

// Low-cost operations
x + y                 // Free
x * y                 // 1 constraint
x == y                // ~1 constraint

1. What operations are inside?
2. How many iterations?
3. Can any operations move outside?
4. Is the loop necessary?

// ❌ Inefficient: hash inside loop
for i in 0..10 {
    hashes[i] = hash(data[i]);  // 10 × 1,000 = 10,000 constraints
}

// ✅ Consider: can this be done in witness?

// Merkle tree with depth 20
const proof = get_merkle_proof();  // ~20,000 constraints

// Consider: Is depth 20 necessary?
// Depth 10 would be ~10,000 constraints