Direct encrypted ballot path
Each voter publishes one encrypted ballot. Verification must check the ballot proof, select the first valid ballot per voter, and recompute the encrypted ballot aggregate from public ciphertexts.
The evaluator is checked by deterministic mobile replay. Only the
finalized and replay-matched C_target can be decrypted.