build: esn/lsm fail to compile — rand 0.9/0.10 version conflict + drifted API

[hyperpolymath]

esn and lsm do not compile — rand version conflict + drifted API

Discovered while standing up the proof scaffold (#84). cargo check -p esn -p lsm fails:

2 × error[E0277]   (trait bounds, rand RNG traits)
7 × error[E0599]   (no method `random` / `random_bool`; trait `RngExt` not in scope)

Root cause

Cargo.lock resolves two major versions of rand simultaneously:

• rand 0.9.4 (pulled transitively, e.g. via ndarray-rand = "0.16")
• rand 0.10.1 (from the direct workspace dep rand = "0.10")

The source in crates/esn and crates/lsm uses an older rand API (e.g. rng.random::<f32>(), random_bool, Normal::new(...).unwrap(), Bernoulli::new(...)) that doesn't line up with the resolved trait set, so RNG method resolution fails. ~9 call-sites across the two crates.

Impact

• The two reservoir crates don't build at all — this is independent of the recent deny(unsafe_code) change (the same E0277/E0599 errors reproduce with that change stashed).
• Blocks Tier 0.1/0.2 verification in proof: first-principles proof-obligation map (foundations → non-trivial) #84 (can't add Kani/proptest to crates that don't compile).

Fix options (needs a decision)

1. Align on one rand — pin rand, rand_distr, and ndarray-rand to a mutually-compatible set so only one rand major resolves, then update the ~9 call-sites to that version's API. (Preferred.)
2. Drop ndarray-rand and seed ndarray arrays from rand directly, removing the transitive older rand.

Also worth checking

Whether any CI job actually compiles/tests these crates — if not, that gap let this land. (PR #81's checks were governance/scan/lint, no cargo build/test visible.)

[hyperpolymath]

Fixed in a4ea2cb — pinned rand = "0.9" / rand_distr = "0.5" (matching the source's rand 0.9 API and ndarray-rand 0.16). cargo check --workspace is now green across all 8 crates.

Remaining follow-up (separate concern): there is still no cargo build/cargo test CI job, which is why this breakage went unnoticed. Recommend adding one so a non-compiling workspace fails CI. Closing this issue for the compile fix; the CI-job gap can be tracked on its own if desired.

---

Generated by Claude Code