How do you detect an under-constrained ZK circuit? By checking Jacobians, then discovering witness locality is still the annoying part.

Seven soundness bugs hide in ZK DSL toolchains, and Liezz finds them by splicing witnesses from different runs.