multiLayerDealRecoversPlaintextRegardlessOfStripOrder

Three layers on, three off in a deranged order, and the plaintext comes back — and the card is unreadable at every step in between.

The second half is the deal's actual secrecy claim, and it is strictly stronger than encryptHidesThePlaintextAndStripRecoversIt's: that one says a single layer changes the value, this one says the value stays changed while any layer remains, which is what "nobody can read a card until the last player releases it" means. It is free — the intermediates are computed anyway — and it is the assertion that reds if some later key turns out to cancel an earlier one.

Mutation receipts. An identity SraScheme.encrypt/strip reds it at intermediate 0; a generateKey that hands back the identity on an instance's second draw reds it at intermediate 4, with recovery green either way — the recovery assertion is the anti-regression here, not the discriminator. Deleting the underCover captures reds the non-empty guard in assertStayedCovered on all three bindings (synthetic — only a body edit reaches it), which is what stops a loop that ran zero times from satisfying "none of them was readable".