10/12 ② A clean run on bdk_wallet @ HEAD. Its seed path bounds the RNG as "impl CryptoRng + RngCore", rejected at compile time if it isn't cryptographic. The exact guard Coldcard lacked. ③ A clean run on SeedSigner @ HEAD: dice hashed as a string (no modulo bias), secrets zeroed after use.