Drop pathDraws' pointer rationale, and file the proved-path rule under the modes item

path.go

@@ -147,7 +147,7 @@ type pathWalk struct {
 type pathDraws struct {
 	s    *session
 	held *hold
-	a    *arm // a pointer: its levels slice held here moves the render's hold set to the heap
+	a    *arm
 }
 
 // walkPath descends tail from n and returns the node it ends at: a folder or

todo.md

@@ -40,7 +40,8 @@ This round, in order:
   decided by `indexOutside(body, '(')` in two of them and by `funcCall` in the rest.
 - Name `pathWalk`'s modes: render, probe, check and cover are chosen today by which
   callbacks are nil and whether `draws` is, and `walkChoice` returns `nil, nil` where
-  none is set.
+  none is set. Make the render mode reachable only through a proved path: a walk that
+  draws no longer checks `carriedByAll`, trusting its caller's probe or `New`'s fences.
 - Have the check mode report the tables a read draws, so `tableRead.drawn` and
   `entered`'s `pinsAncestors` flag stop restating `walkTable`'s draw condition and
   `table.drawIn`'s ancestor rule: a change to how a render draws rows still leaves the