Verifiable Random shuffle — a uniform Fisher-Yates permutation bound to a future drand round the server waits for (typically 3-6s) and verifies locally, with original indices and a reproducible proof transcript.