We lock the exact list of ticket IDs with a cryptographic hash (SHA‑256). At draw time, we generate a secure 32‑bit random number and pick a winner by index. The listHash proves the ticket list wasn’t changed after locking, and rand32 is the random value used to pick the winner.