Prove the density-only model; record the rasters and the decision

The stream harness keeps the analog rendering as the host-test
conservatism reference (rule 13's mask, the duty ladders) and drops the
M101 switch sessions; rule 18 stays as the derived-floor proof, now
satisfied from boot by the precompute. The lifecycle harness's
state-files scenario asserts the derived floor is in $$ before any arm.
The catalog's laser.power-model-switch goes and laser.power-floor reads
the one floor key with no M-code needed. The mswitch drill goes; the
m4corner drill becomes a single density pass; the dpatch drill returns
to density only.

The CAMPAIGN-LOG records the first rasters (254 and 508 DPI grayscale
wedges: tonality held to ~14 pulse slots per pixel, no dither artifact,
one benign stale-verdict suppression under CPU starvation) and the
decision that ends the analog mode - the strike transient fires a spot
at every beam-on, and the finish comparison found no advantage. BRINGUP,
LIGHTBURN, MOTION and SAFETY describe the density-only present.

docs/SAFETY.md

@@ -203,14 +203,12 @@ would not allow.
   under a job left standing, so a long pause ends with the machine disarmed
   and the next emission needs a fresh press. The relock waits for the kernel to
   finish the queue tail so a controlled stop can never leave FIRE driven.
-- **Dose-model switch.** `M101` changes how a commanded power is rendered
-  (full-power pulses at a density, or a continuous beam at a duty). It is
-  refused with the spindle commanded on or the controller not idle, because
-  a change under fire could pair the density model's pinned full duty with
-  the analog model's continuous FIRE; between kernel runs, which end dark
-  and lead with a power byte, no torn state exists. The first run after a
-  switch leads dark (duty 0) until the commanded power lands. A switch
-  reverts at program end and on reset unless the operator made it stick.
+- **Dose model.** Density is the only model: every pulse fires at full
+  power and the commanded level only masks FIRE ticks the core asked for,
+  never adds one, so emission stays exactly where the core commanded it.
+  The analog rendering (continuous FIRE at a duty) is not selectable on a
+  machine - it fires the tube's strike transient as a spot at every
+  beam-on - and exists only as the host harness's conservatism reference.
 - **Coolant fire gates.** The armed window requires a fresh `fire_ok` verdict
   from the cooling engine (flow verification, over-temperature, the airflow
   floors on every fan, lid-IR emission witness); a stale or failed verdict