Smart Contract Diff Audit L-02: Component Namespace Mismatch Makes `NoteCreator::create_note_root` Panic Unconditionally

The Rust wrappers resolve a component's procedure roots by concatenating its `NAME` constant with a procedure name and matching the result against the compiled package exports by [exact path equality](https://github.com/0xMiden/protocol/blob/8411bf093bde25285708faac152b6d7269009617/crates/miden-protocol/src/account/component/code.rs#L61-L77). For the note creator component the two sides disagree: the [manifest](https://github.com/0xMiden/protocol/blob/8411bf093bde25285708faac152b6d7269009617/crates/miden-standards/asm/components/note/note_creator/miden-project.toml#L7) publishes it under `miden::standards::components::wallets::note_creator`, while [`NoteCreator::NAME`](https://github.com/0xMiden/protocol/blob/8411bf093bde25285708faac152b6d7269009617/crates/miden-standards/src/account/wallets/note_creator.rs#L37) is `miden::standards::components::note::note_creator`, matching the component's actual location under `asm/components/note`. No export matches, and the failed lookup is converted into a panic, so the public [`create_note_root`](https://github.com/0xMiden/protocol/blob/8411bf093bde25285708faac152b6d7269009617/crates/miden-standards/src/account/wallets/note_creator.rs#L55-L57) accessor panics on every invocation, since it is backed by a `LazyLock` that forces this lookup on first access.

The defect is masked in-tree, since no caller exists in the repository and the lookup is deferred behind the `LazyLock`, leaving continuous integration green. It surfaces downstream, where procedure roots are the identifiers used to configure per-procedure access control such as RBAC role maps, ACL allowlists, and asset callback slots. An integrator combining the note creator component with any such scheme must obtain the root of `create_note` and encounters the panic on first call. The same mismatched `NAME` also flows into [`NoteCreator::component_metadata()`](https://github.com/0xMiden/protocol/blob/8411bf093bde25285708faac152b6d7269009617/crates/miden-standards/src/account/wallets/note_creator.rs#L59-L63), which reports the same wrong namespace without panicking, so tooling that keys configuration off the canonical component name receives a name that does not match the compiled component it describes. Note creation itself is unaffected, and because the account code commitment covers procedure roots alone, account state is not affected either.

Consider correcting the manifest namespace to `miden::standards::components::note::note_creator`, matching `NoteCreator::NAME` and the component's location under `asm/components/note`, and updating the package name and the `.masp` asset path referenced by `account_component_code!` to match. Where a display name and a published namespace are intended to differ, the established alternative is a dedicated lookup-path constant, as [`TokenPolicyManager`](https://github.com/0xMiden/protocol/blob/8411bf093bde25285708faac152b6d7269009617/crates/miden-standards/src/account/policies/manager.rs#L51-L54) defines. Consider also having `get_procedure_root_by_path` callers return a `Result` rather than panic on a failed lookup, so a future namespace divergence surfaces as a recoverable error instead of an unconditional panic. A test forcing evaluation of every procedure-root accessor in `miden-standards` would catch a future divergence in continuous integration rather than downstream.

---

_Copied verbatim from finding [L-02](https://audits.openzeppelin.com/miden/miden-01-07-smart-contract-diff-audit-nfts/issues/component-namespace-mismatch-makes-notecreatorcreate_note_root-panic-unconditionally-4f61b1c7) (low severity) of the OpenZeppelin [smart contract diff audit (NFTs)](https://audits.openzeppelin.com/miden/miden-01-07-smart-contract-diff-audit-nfts). The audit was performed against commit `8411bf093bde25285708faac152b6d7269009617`._