Cut 1 landed at 835ea4d, and Soul's first pass records all five promises
as holding. External code can build an all-zero LensWeights through
new, Default or Deserialize but cannot reach the draw, because the lens
module and draws are private. So there is no crash path, which matches
L0's unforgeable-admission ruling.
Soul findings:
- duplicate keys are last-wins, like every BTreeMap field in the crate
(recorded);
- the all-zero guard and the divisor are different computations, a
hardening fix that goes to Cut 3;
- a leftover expect(dead_code) produces a warning, not a compile error,
which corrects Hands' claim.
Cut 0's captures and the census baseline are now recorded, and so are
Cut 1's ledger actuals. The ledger no longer says the draw lives inside
the session identity, which the Q4 revision removed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
3cb6a74bb0