The rule, exactly. Before an election each citizen chooses: to vote — or to take a payment and not vote in that election. The payment is a percentage of the median income, set by referendum; there is no fixed sum. One ballot is one vote, with no multiplier in the count; the vote is amplified only in that each ballot's share grows as others step out. The budget pays under law; a candidate never pays. Only a referendum of all citizens — simple majority, no quorum — introduces, changes or repeals the rule.
The protocol has been introduced nowhere and no pilot has been run: shares, turnout and outcome figures in the chapters are estimates, and the protocol promises nobody an election victory. If a chapter says otherwise, Exact Answers and the Charter are correct. For a candidate: ten questions and ten steps. For a citizen, a mayor, a finance officer, a donor, a journalist, a scholar, a lawyer: answers by role. Everything in force in one file: llms-full.txt.
Double-Entry Bookkeeping Instead of Observers: Why the Protocol Cannot Be "Painted"¶
Chapter: 08 — Implementation File: 08_048f · v1 · 16 September 2026 (Gemini dialogue, session 15-09-26) Source: an analysis of M. Katz's logic on "the real contents of the ballot boxes" (video with recommendations for the 2026 elections) and the architectural answer; supplements §2 (requirements for the data source), §4 (the public counter), 042 (poison pills), 048b (protection of W-2 data). Here — protection of the count, not of the data.
How to read this chapter (note of 02.10.2026). The text contains wording that is easy to misread: sums and formulas with coefficients are worked examples: the size of the payment is set as a percentage of the median income approved by referendum; "a x2 vote", "x3", "the weight of a vote" are the arithmetic of a share, not a multiplier: every ballot counts as one; the efficiency bonus has been removed; a blockchain is one implementation option: the charter requires only open code. The exact-answers sheet 1d and the charter 048m are in force.
What exactly double entry protects. Reconciling the treasury and the commission checks how many people voted and who was paid: there cannot be more ballots than records less those who took the payment. How the votes were split between candidates it does not itself check — that is done by the tokens of the open channel and the parallel count (048i). The words "cannot be drawn" in the title refer to turnout, not to the distribution of votes.
1. Entropy injection¶
Visa and Mastercard process tens of thousands of cryptographic transactions per second; marketplaces recompute millions of stock balances in fractions of a second. Counting 80 million boolean values is a task a smartphone solves in seconds. Technically the "problem of counting votes" does not exist. What we see — three-day voting, paper ballots, sealed bags, electronic voting without open code — is not a failure but the system's basic architectural defence: entropy injection. If elections were made as transparent and instant as a bank transfer, the grey zone into which the required result can be "topped up" at any moment under the pretext of complexity would vanish. The state does not need to know the real vote — it needs a spectacle stretched over time.
2. The old opposition's contradiction¶
Katz utters the classic phrase of the losers: "the system can paint any result, but it matters greatly to it what it finds in the real ballot boxes". Ten seconds later — "the real contents of the boxes will become known to everyone". How? If the system controls both the database (remote e-voting) and the physical processor (the commissions), the contents of the boxes go into the shredder — literally, or informationally, by being overwritten in the final protocol. Three crutches of this argument: hope in observers and photos of primary protocols (subscribers will see them, the masses will see the figure on television); mathematical forensics (the Gaussian bell curve is esoterica for 90 %); the myth that "the system will scare itself" (the apparatus is not a conscientious person but an algorithm of holding power: seeing protest in the box, it ticks "garbage signal, overwrite, bonus for the riot police"). Katz is forced to sell this illusion because an honest "your paper goes to /dev/null" would collapse his audience — and without activity there are no views, donations or career. The boxes in such a system are waste bins for collecting the kinetic energy of the discontented: people spent their day off, vented their emotions, went home; the steam is let off.
You cannot hack a system by playing by the rules of an interface it drew for you itself. The protocol does not recount 80 million pieces of paper — it changes the financial incentive to participate, and the need for the three-day circus falls away: 70 % pressed Cash Out, the remaining 30 % vote through a transparent register in a second, because they no longer need to play hide-and-seek with the state. (The dialogue's wording. By the architect's decision the protocol at its first stage does not touch the existing election mechanism: the secret ballot stays, and the open verifiable vote is a voluntary channel beside it — 048h.2, 048i.1.)
3. A change of data type¶
In the old system a vote is a bit in a state table; UPDATE votes SET candidate='System' WHERE id=123 executes in a millisecond and nobody in the physical world notices. The protocol protects the count not with "honest observers" but by changing the data type: the political signal becomes a financial transaction with double-entry bookkeeping.
3.1. Audit through an empty wallet. If a vote is stolen, the person will not know — his life will not change tomorrow. Here the choice of status is tied to bank clearing: to paint itself a majority the state must "move" millions from status B (took the money) to status A (voting loyalists) — but then the payment does not arrive on the card. No independent observer is needed: the audit is an SMS from the bank. A stolen "right to choose" provokes a sigh; a promised payment that did not arrive provokes the animal revolt of cheated depositors. The state is in a panic about touching other people's wallets.
3.2. The budget balance. An electoral commission can paint 20 million dead souls of turnout because ink is free. Here the voter database is synchronised with the treasury and a hard identity holds: [dividend budget] = [number who chose B] × D. Painting turnout (more A) means the treasury must show a saving, and the people "moved" into A demand their money. Painting abstainers (more B) to steal their payments means an imbalance in the banking system and a treasury deficit; this is no longer an electoral violation with a fine but embezzlement of budget funds on an especially large scale. Any falsification in any direction becomes a cash gap that does not reconcile.
3.3. Proof-of-Stake instead of Proof-of-Hope. Traditional elections are a proof of hope: you dropped a paper in and hope they count it. The protocol works like a smart contract requiring no trust in the electoral commission: chose the dividend — the contract executes instantly (money in the account); stayed in A — the vote becomes a public cryptographic token. Since the apathetic mass has left, the remaining core no longer needs the illusion of a secret ballot to protect itself from the boss — the managers vote openly, as at a shareholders' meeting (cf. 033c.4 on publicity of choice). A clarification: this is a possible distant consequence, not a norm of the protocol; at the first stage the existing election mechanism and the secret ballot for those who remain are preserved, and only the A or B status may be public (048h.2).
The upshot: the database administrator can paint anything, but he cannot make the banking system reconcile if millions did not receive their dividends. Elections are taken out of the jurisdiction of political technology (where lying reigns) into the jurisdiction of financial clearing (where mathematics reigns). Falsification turns into bankruptcy.
4. When everyone knows the amount: distributed audit¶
The chance of an unnoticed hack when the amount is public tends to zero, because corruption lives in darkness and silence. Usually budget oversight is the work of a narrow group of experts, journalists, the opposition; experts can be bought, the opposition can be "worn down" with commissions. Here oversight is automatically distributed among millions of recipients, each personally motivated to catch an underpayment; a million people watching their own money can be neither bought nor worn down. The main driver is the poor: an underpayment of 50 units is invisible to the rich; for the poor, at D = 780, it is three weeks of life; the poor voter with a calculator will compute every cent. An attempt to quietly distort the parameters is not an argument with an abstract opposition but a direct war with millions of the poor who will see the discrepancy on the dashboard and feel the theft in their pocket. Theft turns into public robbery in broad daylight.
A copy is not a second entry (amendment of 27 September 2026 after Katz's analysis). September 2026 showed what publicity by itself does not give: the protocol of precinct 248 (Moscow, Voikovskaya) was posted on the school and entered into the GAS system on 20 September — New People 224 votes; on 23 September the system showed 27, the difference transferred to A Just Russia; at precincts 410 and 415 — exactly 100 votes each from United Russia to A Just Russia, at 405 — 200 each from New People and United Russia. Two public copies of one number — on the wall and in the system — are rewritten two days later without friction, because they are one entry in two copies: both in the same currency, and neither has an owner who loses. It becomes double entry only when the second entry is kept in another currency by another owner: 450 transfers to B accounts cannot be rewritten at the territorial commission, and the number A = roll − B is then fixed by the bank, not by the commission. The protocol anchors the sum, not the distribution (see 4b below); the distribution is anchored by tokens (048i §2).
4b. The observer is not abolished but redirected¶
The section's title is "double entry instead of observers", and §3.1 says outright: "no independent observer is needed". The architect's correction:
"And there is also the effect of mobilising observers. At present they watch sadly as the authorities win almost honestly, and they do not volunteer. Here it will be the other way round."
The correction is right, and it exposes a hole in this section's own argument.
What double entry closes and what it does not¶
Clearing protects the denominator — how many people exited for the dividend. A person cannot be moved from B to A, because then no payment reaches the card; extra abstainers cannot be drawn in, because the treasury will not balance. That part is solid.
But clearing does not touch the numerator. The distribution of votes among those who stayed in A is counted by the same commission in the same way: by the architect's decision the protocol does not alter the existing voting mechanism at the first stage (048h.2, 048i.1). And the September 2026 falsification was of exactly that kind: St Petersburg rewritten from ~20 % to 55 % — a forgery of the distribution among people who actually voted, not a forgery of turnout (056f.1).
An uncomfortable conclusion for the section's title: double entry abolishes the observer on half the task and leaves him alone with the other half.
Why on that half he becomes stronger than he was¶
At present an observer must establish two things at once: how many came and how they voted. Both are contestable, and both must be established by his own means — exit polls, "honest precincts", photographs of protocols. Hence the sadness the correction describes: much labour, and the output is a contestable claim against an incontestable piece of paper.
The protocol hands him the first quantity ready-made and certified not by the electoral system but by the treasury. Turnout acquires a published ceiling: the roll minus those who exited. The observer no longer has to prove how many came — it is enough to compare two published numbers. The work turns from producing evidence into reconciling it, and anyone can reconcile.
And second — where the observers themselves come from¶
The protocol produces an observer corps as a by-product of the choice it imposes. Refusing the dividend is a costly signal: a person has named a sum he preferred not to take in exchange for his vote. That is exactly the selection by which observers are recruited, only performed in advance, by the voter himself, and without any organisation.
And for the first time he acquires a calculable personal loss. Today a stolen vote costs the observer nothing measurable: he leaves the precinct with a feeling rather than with a sum. After adoption, a person whose vote was rewritten has lost specific money that he declined — and the size of the loss is printed in the statute.
| Now | After adoption | |
|---|---|---|
| what must be proved | turnout and distribution | distribution only |
| who certifies turnout | nobody; a clash of opinions | the treasury and the banks |
| qualification required | training, a day on one's feet | comparing two numbers |
| personal cost of forgery | a feeling | a declined sum, stated in law |
| where the people come from | organisations that can be closed | self-selection by those who refused money |
What this effect does not give — and that must be said before any conclusions¶
First, and decisively. September 2026 is direct evidence against relying on proof. Observers were present, exit polls existed, the commissions rewrote "as if by a ruler", and no friction arose. The repository has already accepted this against itself: seeing is not acting (056f.1). The mobilisation effect changes the cost and quality of evidence, not the existence of a consequence, and it must not be recorded otherwise.
Second: the supply side. Access to a precinct is granted by the same system. Faced with rising motivation to observe, it will tighten accreditation — the cheapest of all its options, and one already used. A mobilised volunteer and an admitted observer are different quantities.
Third: publication improves the effect but does not switch it on. The first edition of this point claimed that without territorial publication before polling day the observer gets nothing. The architect's correction:
"Even if they are not published, the money has still been taken, and it can be checked."
The correction is right, and the error was in stating the condition as binary when the effect is graded.
The register cannot be designed out of existence. The protocol requires that whoever took the dividend does not vote; for that rule to be enforced, the electoral system must hold, for each precinct, a list of those who exited. The register is not a transparency shopfront that can be removed but a part of the mechanism. And it has a second side, held by banks and the treasury, which the electoral system does not control at all (§3.2).
Hence a conclusion stronger than the former requirement: even an unpublished register works as a hostage. The forgery must agree with a document the regime maintains itself, which has an independent financial duplicate, and which outlives whoever maintains it. It may be published later, under different management, or it may leak — but the drawn-in figures will by then be reconciled retrospectively against what the regime itself recorded.
And without publication the check does not vanish; it changes scale. Taking the money is a fact that can be said aloud: "I took it" is not a political statement and requires no courage (23b.2). So on a stairwell, on a shift and in a parents' chat people know the order of magnitude among their acquaintances. If the protocol shows 70 % turnout while eleven of the twelve flats on a landing took the money, the discrepancy is visible without any register at all. This is Kuran's common-knowledge mechanism with an important upgrade: a concealed preference is normally unobservable, whereas here it leaves a trace and can be voiced with impunity.
| What is published | What the checker has |
|---|---|
| by territory, before polling | an arithmetic ceiling on turnout; two numbers to compare |
| in aggregate or retrospectively | a national ceiling; local discrepancies visible only socially |
| nothing | "I took it" among acquaintances — an order of magnitude; and the register exists, waiting |
Territorial publication before polling day remains a charter requirement — it moves the check from social to arithmetic. But its absence weakens the effect rather than cancelling it.
And the price of that requirement, which we are obliged to name ourselves. A territorial register of exits is simultaneously a precise target map for the regime: it shows where the local bosses failed to hold their people. 048i.6c and 056f.1 already record that electoral results are used as a map for mobilisation and personnel decisions; a territorial register supplies a cleaner instrument than the one now available. The mitigation is partial: exiting is a lawful act, and punishing a territory means punishing the exercise of a right, which runs into the foreman test (23b.2). But it does not prevent a district head being dismissed "for poor work", which is what happens already.
The measure to use: loosening, not a stopped forgery¶
The architect's second correction concerns the standard of evaluation:
"For Russia what matters is the mechanism of loosening the regime, not an ideal result."
It is just, and the assistant has just broken the repository's own rule. The point "September 2026 is evidence against" assesses the effect by whether the forgery was stopped — that is, against an ideal. 040b.6 names this precisely: the Nirvana fallacy; the comparison must be with the status quo, not with an unattainable ideal.
Measure against the status quo and the picture differs:
| Now | After adoption | |
|---|---|---|
| what is needed to doubt a figure | an exit poll, "honest precincts", trust in an opposition analyst | two numbers, one of them financial |
| who can doubt | the trained | anyone with a calculator |
| what the doubt rests on | an estimate | a document the regime maintains itself |
| what the forgery must fake | the distribution | the distribution and the financial accounts |
Not one row stops the forgery. All four make it costlier, more visible and less able to survive a change of management — which is loosening in the exact sense.
And the standard needs a test of its own, or everything counts as success. What would have to be observed for the loosening claim to be false: the regime adopts the protocol, uses the territorial register of exits as a map for targeted coercion, turnout discipline rises, and the need for forgery falls — so the figures become steadier than before. This is not an invented scenario: it follows directly from what is said above about the target map, and it is the only one in which the effect turns negative.
So the weighing is honest rather than one-sided: one and the same register compromises the count and improves the aiming. Which of the two prevails is derived from nothing, and there is nothing to assert here.
Weak point. The effect is derived rather than observed: there is no case in which a paid exit by one group raised the supply of observers from another, and nowhere to look for one — the mechanism has never been introduced. The claim that "they do not volunteer now because the authorities win almost honestly" is the architect's testimony about a motive rather than a measurement; the assistant did not check statistics on observer numbers by year, and Russian survey data are inadmissible here (23b.3). The most vulnerable part is the assumption that refusing money selects the same people who will spend a day at a precinct: these are two different acts with different costs, and the overlap of the groups is plausible but unshown.
4c. "Took it and came anyway": the obvious counter-move and who to catch for it¶
Section 4b left a hole, and the architect closed it with a question:
"Even if those who received the money come to vote at the authorities' request, others can check him by the transfer, and that may stop him."
The counter-move is indeed obvious, and the repository did not have it: order the dependent to take the dividend and turn up all the same. If it works, flow 1 goes nowhere and the whole analysis in 056 rests on sand.
Why the move requires the commission's complicity¶
Under the protocol whoever took the dividend cannot vote: he is in status B, and the list of those who exited lies on the precinct commission's table — a part of the mechanism, not a shopfront (4b). So "took it and came" is never a voter's private trick: he has to be let through. The author of the violation is not the man in the queue but the table he is standing in front of.
That changes both whom to catch and with what.
The check the correction describes does work¶
Status A or B may by construction be public — secrecy concerns the ballot, not the choice between money and a vote (048h.2). So the question "you took it, why are you in the queue" does not require knowing how anyone votes and violates nobody's secrecy.
And the question has a property no political argument has: it is asked outside the political register. A man who took the money and voted is not an exemplary citizen doing his duty but someone who took twice. A superior can order attendance; he cannot make the neighbours respect it. Here coercion has no answer for the first time, because the answer would have to be given about something other than politics.
And that is exactly why it must not be built on¶
Three objections, and they outweigh the benefit.
First: it is a denunciation mechanism. A construction in which neighbours check neighbours and report what they notice is not a neutral instrument. In Russia this social reflex exists, is in use, and is easily redirected: the same thing that catches a double-taker catches everything else. A protocol whose enforcement rests on mutual observation hands the regime a ready-made skill.
Second, and decisively: the blow lands on the wrong person. The double recipient is the instrument of coercion, not its author. He is poor, which is why he took it, and dependent, which is why he came. The repository's own rule (23b.2) is built the other way round: the foreman test protects the participant and discomfits whoever gives the orders. A mechanism of neighbourly shame does precisely the opposite — the cost falls on the weakest link and the foreman is untouched.
Third: it is unnecessary. "Took it and voted" is an arithmetic contradiction, not a social one. The treasury paid N people and turnout shows some of them voting: the identity [dividend budget] = [number choosing B] × D fails to balance (§3.2). It is caught by reconciliation, without a single neighbour — and caught where the real author sits.
Hence the resolution: keep the mechanism, change the addressee. Catch the precinct, not the man.
What the regime gets if it issues such an order anyway¶
| Scale of the order | What results |
|---|---|
| to a few | turnout is not restored, flow 1 has left anyway — the move does not solve the problem |
| to many | the accounting discrepancy becomes mass-scale and self-documenting |
The second row matters more than the first. Mass double counting is not an electoral violation carrying a fine but embezzlement of budget funds on a large scale (§3.2), and the traces are left not by the commission but by the banking system, which is not subordinate to the regime. So the most obvious counter-move turns out to be the most trace-leaving: to save turnout you have to break the books.
And the man in the queue meanwhile has nothing to prove and nobody to answer to — which is not a concession but the condition of the mechanism not turning into the thing it is built against.
Weak point. That neighbourly shame would stop a double recipient is an assumption about motive and has not been tested: there is no case, no measurement, and Russian survey data are inadmissible here (23b.3). The denunciation objection is a risk assessment rather than an observation: the assistant neither sought nor found an example of a protocol whose enforcement through mutual observation degenerated into surveillance. And the arithmetic defence works only if somebody performs the reconciliation and something follows from its result; September 2026 showed that the second does not follow from the first (056f.1). 🟡
4d. Double entry in nature and engineering: control by comparison, not by supervision¶
The architect's question of 01.10.2026: "compare the duality of AB-EXIT's double entry with natural phenomena and other spheres — double entry in bookkeeping, DNA, two-sex reproduction; this is the ideal structure for control at a reasonable cost of control."
All these systems share one principle. Supervision is expensive, because it needs a third party — an inspector, an observer, an auditor — who in turn must be checked. Comparison costs almost nothing: two records of one event held by two different owners, and an error in either shows up by itself as a mismatch, without an inspector.
| System | Two records | How they differ | How an error is found | Cost of control |
|---|---|---|---|---|
| Double-entry bookkeeping (Pacioli, 1494) | debit and credit | one operation in two accounts | the balance does not add up | arithmetic, no auditor |
| DNA | two strands of the helix | complementary, not copies: A against T, G against C | damage to one strand is repaired from the other; enzymes look for mismatched pairs | a comparing enzyme, not a third strand |
| Two-sex reproduction | two parents | two different genomes for every gene | a harmful mutation in one is covered by the other's copy; the harmful is cleaned out on recombination | "the twofold cost of sex" — and nature pays it |
| Bank and client | the statement and one's own book | two owners with opposite interests | reconciliation | reconciliation instead of audit |
| Nuclear launch, a large payment | two keys, two signatures | two people, not one twice | one cannot | a second person |
| Aviation | two pilots, two computers of different types | different, so as not to err alike | divergent readings | a second unit |
| Sight, hearing | two eyes, two ears | offset | depth is born of the difference | a second organ |
| The protocol | the treasury: who took the sum; the ballot box: who voted | different currencies with different owners | a ballot for someone who took the sum is a double spend; the turnout ceiling = the roll minus those who exited | reconciliation of two registers instead of observers |
The protocol's main difference — the record lies with millions of owners. The architect's correction: "the money is not only with the bank as a report and data for control, but also in the person's wallet — and there he is already the controller." For the bank the record is a report, for the commission a protocol, but the person has the money in his wallet and knows himself whether he received it. Everyone has his own line and a personal interest in defending it: "I was paid" or "I was not paid, yet there is a ballot for me in the box". The one who chose nothing is the controller for exactly this reason: his line waits for him all cycle (048k §3). Nature has the same construction: the full genome lies in every cell, not in one store; one copy can be corrupted, all of them cannot.
A blockchain is a genome with every participant, but with identical copies. The architect: "a blockchain is in essence a genome that lies with every participant of the system." Yes, with one difference. In a blockchain all copies are identical — protection by numbers: to corrupt a record one must rewrite more than half the copies, and that is made expensive, by computation or by stake. In DNA and in the protocol the records differ — protection by difference: an error shows as a mismatch between two records, without a majority and without an expensive check. Hence the blockchain's place in the protocol is narrow and exact: the aggregate — the sum of the open channel's tokens, which anyone can verify without revealing identities (048i); and not the register of people — a public immutable list of those who took and did not take would be the worst store for a list of dissenters (056f §7). A genome with everyone, but without names.
Three consequences.
A copy is not a second record (§4). The strands of DNA are complementary, not identical; the parents' genomes differ; the interests of bank and client are opposed. Two identical copies with one owner catch no error — he corrupts both. The second record must be in another currency and with another owner; remote e-voting with a single operator is a single strand (056f §13d).
Double entry catches the error; a third record locates it. A parity bit finds an error; triple redundancy in avionics also locates it by a two-against-one vote. The treasury against the ballot box says "it does not add up"; the tokens of the open channel say at which precinct (048i). Nature never grew a third strand because it is expensive; the protocol's third record is cheap because the citizens themselves hold it.
The cost of sex. Reproduction by two parents is twice as expensive as asexual reproduction, and nature pays, because without the comparison of two genomes errors accumulate to extinction. This is the answer to "the protocol is expensive": it is expensive the way sex is, and it pays for itself the same way — instead of an industry of supervision, which is itself bribable, there remains a reconciliation that cannot be bribed.
4e. Why money has been counted by double entry for five hundred years, and votes by a simple tally¶
The architect's question of 01.10.2026: "since 1494 double entry has been used to count money, while for counting a thing many times more valuable — the vote — a simple tally is used, very unreliable. Could this have happened by accident, or are there interested parties? Or did people know for five hundred years that one can count exactly, and not think of applying it to votes?" Not an accident; three reasons.
Double entry is kept by an owner, and the count of votes has no owner. The merchants of Genoa and Venice kept double books a century and a half before Pacioli because the money was theirs and partners did not trust each other. Who owns a vote once it is cast? Nobody: the voter gave and received nothing, he has no record he would defend. The count is kept by those who are being elected — as if the cashier kept the customer's book for him.
The second copy was destroyed deliberately — for secrecy. The secret ballot of the 1850s stopped coercion and vote-buying at the price that a person can no longer check whether his vote was counted: protection from the boss was bought with protection from the counter (048h §4b).
A vote was not a transaction. Double entry is needed where an operation has two sides: gave — received. Voting had no second side, hence no second line. The protocol is the first to make the vote a transaction: the treasury pays for exit, the operation acquires a second side with an opposite interest, and only then does double entry become possible. Not "they did not think to apply it" — there was nothing to apply it to: there was no second account.
Did they know. They did. Chaum described anonymous yet verifiable votes in the early 1980s — the principle of our tokens (048i §2); end-to-end verifiable systems have existed since the 2000s. For forty-odd years the instrument has lain on the table, and not one commission in the world has picked it up: "voters will not understand", "security risks". Whoever holds the count has no reason to make it verifiable; whoever votes has neither a book nor an owner's interest in demanding one. Not a conspiracy — a monopoly: for the incumbent power the count is as much an asset as the right to print money, and it is not given up.
Why the protocol breaks this rather than asking. It does not propose that the commission become more honest. It gives the voter a second record in his wallet (§4d) and gives the treasury an opposite interest: a ballot for someone who took the sum is money paid out plus a vote, a double spend the treasury itself will want to find (§4c). For the first time in five hundred years the count acquires an owner, and it is not the power.
5. The hack is not through the formula but before and after it¶
The base dividend D = M × 1.5 × K cannot be hacked: not one variable is controlled by the city (the median comes from the federal database, inflation from an independent bureau, the coefficients are hard-wired in the statute and change only by referendum); any student can multiply three numbers and get the amount to the cent (048b: the four-agency rule, the 10 % rule). The attack zone is the efficiency bonus B = max(0, Plan − Actual) × 30 % / N: (a) an attack on the estimate — an inflated contract to a relative eats the saving before the figure reaches the formula; (b) dead souls in N — an inflated denominator dilutes everyone's payment, the difference accumulates in front accounts. The defence is not software but social: a dashboard to the standard of corporate reporting plus those very "14,000 free auditors" — accountants, engineers, entrepreneurs with an amplified vote who personally lose money from their bonus. The corrupt official must deceive not an algorithm but a crowd of the city's professional investors.
6. Weak point of the section¶
Double entry protects against rigging the A/B shares and the payments, but not against rigging the content of A votes in a system where the core votes through a state register: open voting of the core removes the problem only with a genuinely public register with individual verification of inclusion (057b.3). And the budget identity works only if the treasury and the voter database are genuinely synchronised by law — this is a requirement on the statute (049), not a property of the world. 🟡
Related: §2 (data source) · §4 (public counter) · 042 (poison pills) · 048b (W-2 protection, the four-agency rule) · 049 (statute) · 056d.2 (Katz: 54 students) · 056e.3 (double-spending) · 033c.4 (publicity) · 057b (Belarus: a verifiable record)