The registry as the box holds it, and the one act that closes the poll.
A7
What does not survive a restart
The registry, the hash chain and the accepted ballots are in memory. A real
ballot box does not forget its contents when its process stops, and the
receipts voters hold would then refer to a chain that no longer exists —
which is exactly the evidence the design says they are. A poll that reaches
its close is written out and can be served again; one interrupted while
open is not.
| state | … | |
| submissions accepted | … | |
| ballots that will count | … | |
| rejected | … | |
| chain head | … | |
The two figures differ because a voter may supersede their own ballot: every submission that passes both signature checks is accepted and kept, but only the last one under each ad-hoc key is counted. While the poll is open they are also figures from different moments — submissions are counted live from the commitments, whereas the ballots that will count are only known from the last published report. Subtracting one from the other therefore means nothing until the close.
Each entry stores the hash of the one before it, so the head depends on every record and on their order. A voter holding a receipt can show a discrepancy rather than merely allege one.
An act of the box performed by an operator, not a clock (E1). Until it happens the records are withheld and only commitments are published; afterwards every record is released in clear, accepted and rejected alike, and anyone can recount. The box is also the sole witness to its own stopping — which is what supervision by competing parties would answer, and this demo cannot.
The cadence is set on the setup console before the poll opens, and the trigger is the clock rather than the arrival of a ballot: a report goes out at every boundary whether or not anything changed in the window, because an electorate waiting for one learns something from its absence too. The close is always a publication point, so an interval longer than the poll means the close is the only one. Nothing here is privileged — every figure below is published, and between boundaries the operator sees no more of the result than anybody else.
| published at | accepted | will count | how they fell |
|---|---|---|---|
| … | |||
Released at the close, when every record is published in clear and any citizen can recompute this independently. Out-of-range selections are reported by the distinct value each voter cast rather than merged into one figure, so an organised protest is not flattened into "invalid".
—