The rule, exactly. Before an election each citizen chooses: to vote — or to take a payment and not vote in that election. The payment is a percentage of the median income, set by referendum; there is no fixed sum. One ballot is one vote, with no multiplier in the count; the vote is amplified only in that each ballot's share grows as others step out. The budget pays under law; a candidate never pays. Only a referendum of all citizens — simple majority, no quorum — introduces, changes or repeals the rule.
The protocol has been introduced nowhere and no pilot has been run: shares, turnout and outcome figures in the chapters are estimates, and the protocol promises nobody an election victory. If a chapter says otherwise, Exact Answers and the Charter are correct. For a candidate: ten questions and ten steps. For a citizen, a mayor, a finance officer, a donor, a journalist, a scholar, a lawyer: answers by role. Everything in force in one file: llms-full.txt.
Secrecy, Verifiability and the Price of Coercion: the German Court, a "Tracking Number for a Vote" and the Mirror Attack¶
Chapter: 08 — Implementation File: 08_048h · v1 · 19 September 2026 (Gemini dialogue on E. Schulmann's broadcast "School of Elections: Answers to Questions from Russia"; verified against primary sources) Source: the judgment of the German Federal Constitutional Court of 3 March 2009 (2 BvC 3/07, 2 BvC 4/07); the Netherlands' abandonment of Nedap machines (2007–2008); Estonia's internet voting (2023); A. Hertel-Fernandez, "Politics at Work" (2018); OSCE/ODIHR observations on family voting; Erlam v Rahman (Tower Hamlets, 2015); M. Svolik, "The Politics of Authoritarian Rule" (2012). The architect's corrections: "the mechanism must be a balance between verifiability and security", "the protocol does not remove the current election mechanism at the first stage, it removes the noise", "those who left for money shrink the field for manipulation but do not make the count fully exact". The broadcast's content could not be verified; theses about it are given by paraphrase. Supplements 048f (double entry), 056d.4 (the price of coercion), 039b.3.3 (household coercion), 057b.3 (pilot requirements).
How to read this chapter (note of 02.10.2026). The text contains wording that is easy to misread: "a x2 vote", "x3", "the weight of a vote" are the arithmetic of a share, not a multiplier: every ballot counts as one; the efficiency bonus has been removed. The exact-answers sheet 1d and the charter 048m are in force.
1. What the German court decided — and what it did not¶
The court found the use of Nedap machines in the 2005 Bundestag election incompatible with the Basic Law and derived the principle of the public nature of elections: the essential steps of voting and of determining the result must be examinable by the citizen reliably and without specialist knowledge. Two details usually lost in retelling: the court did not ban electronic voting as such — it required verifiability; and it did not annul the 2005 election, judging the possible effect of the errors on the Bundestag's composition marginal. The Netherlands decertified the same machines on 1 October 2007 after the campaign "We do not trust voting computers" and from 2008 returned to paper and a red pencil. Estonia went the other way: in 2023, 51 % of the votes in the parliamentary election were cast online.
The architect's correction: the principle "verifiable by anyone without knowledge" is a legal fiction for paper too. A blind person does not see the tick, an illiterate one does not read the ballot, and both must trust a helper. Any system is a balance of three requirements that cannot all be met at once: verifiability, secrecy, accessibility. The dispute is not about whether there is trust but about to whom and under what audit it is handed.
2. What the protocol does to existing elections¶
At the first stage — it breaks nothing. Polling stations, ballots, commissions and the secret ballot for those who stay to vote are preserved; the protocol works as a filter before the election, taking the uninterested off the stations. This is fundamental, and it diverges from the wording in 048f.3.3 ("the remaining core votes openly, like a shareholders' meeting"): open voting by those who remain is a possible distant consequence, not a norm of the protocol. The secrecy of the choice of candidate stays; only the A or B status may be public (033c.4).
Hence the honest boundary of double entry (048f). It closes: painting turnout, dead souls, substitution of the A and B shares — everything that runs into the identity [dividend budget] = [number of B] × D. It does not close: the content of the ballots of those who stayed. The architect's formula is more precise than the model's: exit for money shrinks the field for manipulation but does not make the count exact. The field shrinks substantially: lists of non-voters are the main resource for ballot stuffing, and precisely they disappear when non-attendance becomes a recorded transaction.
3. Why a vote cannot have a tracking number¶
The architect's analogy: "I ordered goods, they travelled three days and did not arrive — I have a receipt and a tracking number; why not the same with a vote?" Because a receipt proving how you voted proves it not only to you. With it a vote can be sold with a guarantee and an account can be demanded: by a boss, a husband, a local strongman. That is why the law gives no right to voluntarily disclose one's ballot: voluntariness under pressure cannot be told from coercion, and one permitted signed ballot cancels the protection for all. This property is called receipt-freeness.
The hybrid the architect proposed ("whoever wants verifies by phone, whoever doesn't uses a ballot") exists as a class of end-to-end verifiable systems (Helios, Scantegrity, STAR-Vote): the voter gets a receipt proving that his vote is included in the count but not showing for whom it is. The model brushed them aside too quickly; their real weakness is different — only a handful understand the verification, and a dispute over a mismatch is won by whoever holds the server. Estonia solves coercion another way: an online vote can be re-cast any number of times, the last one counts, and a paper ballot overrides the electronic one — someone who voted under supervision can later re-vote alone.
4. Coercion: how much of it there really is¶
The thesis "in developed countries nobody has been killed for a vote for a long time, pressure is below the margin of error, secrecy has become a relic" is wrong in two places. First, the data: in the US in 2015 roughly one worker in four received political contact from an employer, and 46 % of managers reported that their firms mobilise employees; OSCE observers in individual missions recorded family and group voting at about a quarter of the polling stations visited; in 2015 an English election court voided the Tower Hamlets mayoral election for bribery and undue spiritual influence. Second, the logic: a low level of coercion is a consequence of secrecy, not proof that it is unnecessary. Removing the lock because there have been no burglaries for a long time is survivorship bias. People with placards at a rally refute nothing: public support for someone you like and a provable vote against someone you depend on are different situations.
4b. The balance of secrecy a century and a half on: the plus has weakened, the minus remains¶
The architect returned to the question after the analysis of what observers and the count are worth (013d.6c): "the secret ballot was invented for safety, but today all its pluses are almost unneeded, while its vulnerability to manipulation has remained. We have got only the minuses." The section above rejects this thesis in its full form, and the architect himself agreed at the time, proposing three channels instead of abolishing secrecy (048i). But after 013d.6c the balance is worth recomputing: one of its pans turned out heavier than was thought.
| Why it was introduced (Australia, 1850s; England, 1872) | What has become of it today | |
|---|---|---|
| Plus: the buyer cannot check how the seller voted | To kill the market in votes and the pressure of landlord and master | Weakened. A phone in the booth allows the ballot to be photographed; the buyer has learned to pay for the result by polling station, not by person — in Moldova in 2024 the rate doubled "if the station votes the required way" (019d.2). The protection remains for one who wants to hide his vote and has vanished against one who wants to sell it |
| Plus: a dependent person can vote against the one he depends on | The employee, the tenant, the family member | Remains and is needed: employer pressure and family voting are measured today too (§4). This is no relic |
| Minus: the result cannot be verified by the one who voted | Was thought an acceptable price | Turned out dearer than supposed: the whole system of external checks limits forgery to roughly ten to fifteen points, not to zero (013d.6c), and that is enough to decide most elections |
What secrecy gives people today — point by point. The architect asked for a list and asked first to look for answers in the repository itself. They are there, and one of them is unexpected: the repository's own mechanism rests on secrecy.
| Plus | Where in the repository | State today |
|---|---|---|
| A dependent person votes against the one he depends on: a boss, a union chief, the head of the family, a commander. "The leader can give the order but cannot check" | 018.31.3, 015c.5, §4 above | Works and is needed: employer pressure and family voting have been measured |
| Deceive the deceiver: take the vote-buyer's money and vote one's own way. 018 says outright that this construction "works only under full secrecy", and it is named the first level of the triple defence | 018.43.1–43.7 | Works partly: photographing the ballot and payment "by polling station" erode it but do not cancel it. In Moldova in 2024, 138 thousand people received money for a "no" vote — and "no" lost all the same (019d.2) |
| No list for reprisals after a change of power. In Venezuela in 2004 the list of those who signed the demand for a recall referendum on the president was published, and for years people were dismissed from public service on the basis of it (from the assistant's memory) | Was not in the repository | Works and is needed precisely where power changes rarely and takes revenge |
| Peace in the family, at work and with customers: nobody is obliged to explain his choice | Was not in the repository | Works; a small but mass plus |
So "the pluses are almost unneeded" is not borne out by the repository's own sections: of four pluses three work fully and one partly, and on that one rests the argument of 018 that vote buying loses its point after the protocol. What remains true is the second half of the thesis: the vulnerability to manipulation has gone nowhere and costs more than was thought (013d.6c). Hence the construction of three channels: do not take secrecy from those who need it by the first three rows, and do not impose it on those to whom verifiability matters more. And hence too the open question recorded in the question base as priority number one: choice B itself cannot be secret, because a payment follows it (docs/qa, the implementation section) — that is, the protocol itself creates one new list, and the rules for handling it (019d.4b: aggregates only, no conclusions about a person) matter more than everything listed.
Magnitudes: is the problem exaggerated. The architect objected to the first row: "voting on a phone, remotely and secretly, solves this; if a person really has such a problem, he can install the app, vote and delete it. Check the figures: are there many such cases in the United States, Europe and Moldova? And again, one can take the money if one is pressed hard. We are not in the Middle Ages; perhaps the problem is exaggerated for today's society." The figures that could be found:
| Where | What was measured | How much |
|---|---|---|
| USA, 2015 | Workers contacted by their employer about politics | 25 % |
| USA, 2015 | Of those, who received a warning about losing their job, pay or hours | 20 %, that is, about 5 % of all workers |
| Russia, 2011 | Employers engaging in political mobilisation of staff | just under a quarter; threats at work are the most common form of voter intimidation |
| OSCE and Council of Europe observation | Polling stations where observers saw family voting | Kazakhstan 2004 — 25 %; Montenegro 1998 — 20 %; Azerbaijan 2005 — 19 %; Kyrgyzstan 2005 — 10 %. In 1995–2001 the problem was noted in 16 countries of greater Europe |
| OSCE/ODIHR observation, 2025 | Polling stations where observers saw group voting, "mostly family voting" | Albania, parliamentary elections of 11 May 2025 — 11 % of voting centres, proxy voting "often for family members" — a further 3 %; Moldova, parliamentary elections of 28 September 2025 — 1 % of observations, secrecy of the vote compromised in 4 % (ODIHR final reports; added 23 September 2026) |
This has to be read both ways. In the architect's favour: in rich democracies direct coercion is measured in single percentages and mostly concerns turnout and public stance, not the choice in the booth — gangs at polling stations belong to the textbooks. Against: in the post-Soviet space and the Balkans — that is, exactly where the protocol is aimed first — it is a fifth to a quarter of workers and stations, not a rounding error. The final reports of 2025 differentiate that estimate: in Albania group voting was seen in 11 % of voting centres, in Moldova in 1 % of observations; the phenomenon persists in the Balkans and has almost gone in Moldova. For 019e.5b this is the measured "today". And the caveat of §4 stands: where the figures are small, they are small with secrecy in force.
On a remote secret vote. It removes the pressure of the boss and the commission but moves the risk into the home: there is no booth, and the head of the family may stand at one's shoulder. The solution is known and coincides with what the architect proposed: in Estonia an electronic vote may be cast any number of times, the last one counts, and a paper ballot overrides the electronic one (from the assistant's memory) — a coerced person votes as told in front of a witness and later re-votes alone. And the argument "one can simply take the money" is already recorded as an exit for the coerced (§5): to whoever is being pressed the protocol gives a lawful way not to take part at all, and he is hard to punish for it — "we just took the money" (015c.7b).
The practical upshot: the dispute over how large the problem is does not change the construction. A secret channel remains — remote or paper — for everyone who needs it, however many they are, five per cent or twenty-five; nobody proposes taking it away. The only question is that it should cease to be the only one.
Why an example from a mafia state is here. The architect objected to the third row of the table: "yes, but it will not work here. And the current voting works badly there as well: a man with a pistol may stand by the ballot box and check where the tick is. Why do we need these mafia states in the repository?" The objection is accepted in the main: measuring the protocol against a state where an armed man stands by the ballot box is the same comparison with an ideal, only turned inside out. Nothing works there — neither the secret ballot, nor the open one, nor the payment — and the section should not pretend that secrecy saves anyone there. Countries fall into three groups, and the example is needed for only one.
| Group | What happens to ballot secrecy | Does the protocol need this example |
|---|---|---|
| Stable democracies | Coercion is single percentages; nobody compiles lists for reprisals | No |
| Imperfect democracies and hybrid regimes — Moldova, its neighbours, most countries the protocol is aimed at | Power changes hands but takes revenge; pressure from employers and "insiders" is measured in a quarter of workers and polling stations | Yes, and only as a design requirement |
| Mafia states | Nothing works, the elections in force included | No: there the question is not the ballot (048d, 057) |
The design requirement is this. The Venezuelan example matters not for where it happened but for what the list was made from: not from ballots but from an open roll of signatures under a lawful demand. The protocol too creates a roll — who took the sum and who stayed — and this is the only place where ballot secrecy and the protocol really collide (the first-priority question in the question base). Hence the rule already recorded in 019d.4b: only totals by polling station are published, an individual's status is not public information, and conclusions about a person from his choice are forbidden. This requirement is needed for the second group of countries; in the first it costs almost nothing, in the third it decides nothing.
The fourth row and polarisation. The architect objected to that as well: "if you are disliked on party grounds, then either you are a marginal and it is mutual, or your party is strange. AB-EXIT is needed precisely to remove the two-party system." The first half is not borne out by data; the second is a hypothesis with an argument against it as well.
Dislike on party grounds is today not the lot of marginals. In the United States in 1960, 4–5 % of respondents would have been upset at their child marrying someone from the other party; by 2010 it was a third of Democrats and half of Republicans. That is tens of millions of ordinary people in the two main parties. While that is so, being able to explain one's choice to nobody is a plus for the majority, not for eccentrics. But the architect is right about where this came from: such dislike is a product of a politics that wins on outrage, because outrage is the cheapest way to bring an indifferent person to the polls. It is a symptom of the same disease, not an independent value of secrecy.
Whether the protocol removes the disease itself is analysed in 013d.5: there are data both ways, and it must not be passed off as settled.
So the exact formula is not "only the minuses remain" but "one plus of four has weakened, three remain, and the minus turned out twice as heavy". What follows from it is not the abolition of secrecy but what the protocol already offers: secrecy becomes a choice for whoever needs it, not an obligation for all (048i); beside it appears an open verifiable vote for those to whom it matters more to know they were counted; and above both — the arithmetic ceiling of double entry, which does not depend on which channel a person used (048f.3). Secrecy remains the lock on the door; the house simply also gets a meter.
On who will object. The architect remarked that the argument "you are breaking democratic institutions" will, after the protocol, be voiced by those no longer in power. That is likely, and the answer should be not an argument about values but a list: the polling station is in place, the ballot is in place, the booth is in place, secrecy is there for everyone who chose it; a payment, an open channel and a meter have been added. Nothing is broken; those who propose breaking something are the ones who want the meter removed. 🟡
5. What the protocol really handles: an exit for the coerced and a floor price for a vote¶
The architect's reply to the scenario "the boss demands proof": "then I'll just take the money". This is a new property the old system lacks. Today a dependent voter has two options: obey or take the risk. The protocol gives a third — a lawful, economically explicable and socially safe exit: "I am not against you, I just need the payment more" (056d.4).
The economics of coercion change in four places:
- Coercion stops being free. The order "go and vote as required" cost the worker half an hour; the order "give up D and vote as required" costs him D. The instigator has to compensate D and add a premium for the risk of complicity.
- Scale makes it visible. A thousand workers is a thousand D plus premiums; such sums cannot be handed out in envelopes or passed off as a "bonus" without a trace for tax and financial oversight.
- Profitability goes negative. When the price of one coerced vote is a multiple of D, the seat being fought over stops repaying the purchase; that is the floor price of a vote (059d.5).
- Collective refusal. If the boss has frightened everyone, everyone will take the money; he cannot fire them all — production stops.
The architect's observation about the mafia: it is strong in poor neighbourhoods, that is, exactly where D weighs most (019b, 040c.1.5). In the old system the strongman gave a hand-out and looked like a benefactor; by demanding that people give up D for his candidate he takes a large sum from the poor and turns from patron into robber. The district can be held only by paying each person his D from one's own pocket — and that business model was built on taking, not on handing out.
A precedent: the secret ballot itself moved the market to buying abstention. Cox and Kousser ("Turnout and Rural Corruption: New York as a Test Case", 1981) showed from the newspapers of rural New York in 1879–1900 that while the ballot was open, parties paid for turnout and for the vote; after the secret ballot was introduced they switched to paying the opponent's supporters not to turn up — the choice in the booth could no longer be verified, while non-turnout is visible in the rolls. Nichter ("Vote Buying or Turnout Buying?", 2008) describes the same on modern data: the machine pays not for how people voted but for whether they came, because only that is observable. This is the protocol's premise, found by the market a century before it: non-turnout is verifiable, the choice is not. The protocol takes the same verifiable quantity and makes it payable, only the state pays everyone by a formula rather than a party paying the chosen in secret; the vote-buyer then has to outbid D (§5, 019d §4).
6. The mirror attack: forced exit — compared with what exists now¶
The objection. Everything in §5 is true of coercion to vote a certain way, but the protocol opens the reverse move — coercion to exit. Status B is provable by a bank statement, it costs the instigator nothing (the state pays), and it looks not like coercion but like "everyone takes it, take it too". It benefits an employer with a disloyal workforce, a domestic tyrant (039b.3.3), a local strongman.
The architect's correction: "you compared with the ideal again. Bribery and intimidation are just as possible now, and so is a phone photo of the ballot in the booth. The protocol at the very least turns a +1 vote into zero. And forcing a worker to lose money is much harder than now, when it is free." The correction is accepted. The first version of this section called the attack "the most serious unclosed spot", having compared the protocol with a receipt-free abstention — and no such abstention exists. The comparison with the system in force:
| Now | Under the protocol | |
|---|---|---|
| Coercion to vote for the required candidate | Free for the instigator; verified by a ballot photo, home and postal voting, electronic voting under supervision; the result is +1 for the instigator, and if the person was opposed — a swing of two votes | Costs D plus a risk premium; visible at scale; negative return (§5) |
| Coercion not to vote | Already possible, free and verifiable: turnout is visible in the rolls, and in many countries participation history is public data; the coerced person gets nothing | Possible and verifiable by a statement; the coerced person gets D; the result is zero instead of a vote against |
| What the instigator gets | A full vote in his favour | At best, someone else's vote removed |
Two conclusions. First: forced abstention is not a new capability, it exists and is verifiable today; the protocol adds to it only a payment to the victim. Second: the instigator is forced to move from a strong attack to a weak one — from "+1 for me" to "0 for him". On an indifferent worker the effect is nil; on an opponent — half the former swing.
The honest remainder. In votes the attack is weaker; in shares — not always: in a shrunken pool each removed opponent weighs 1/(N − M). With half exiting this equals today's swing from a coerced vote (2/N); with 70 % exiting — more. What limits the attack is something else: those who can be coerced are mostly the dependent, and the dependent, by the protocol's logic, take the money voluntarily anyway; the circle "dependent, yet would refuse D on principle" is narrow, and the instigator rarely knows by name who is against — the order "we all take it" removes his own supporters from the election too. Countermeasures narrow the circle further: a window for changing the decision on the Estonian model (chose B in front of the boss, switched to A before the deadline, the last choice counts), secrecy of status as a right, crediting only to a personal account with a ban on deductions, a criminal norm on pressure over the choice of status. The size of that circle is a question for a pilot.
Amendment of 30.09.2026 (048k §3). The countermeasure "chose B in front of the boss — switched back to A before the window closed" is withdrawn by the architect's decision: whoever took the money exits for good. Otherwise collusion arises — people take the money en masse and go to vote, and the turnout ceiling set by the number of exits stops being a ceiling. Against forced exit there remain the notification to the person at the moment the sum is taken on his record, the period for contesting, the provisional ballot and the criminal offence (048i §5c). The same decision makes the secrecy of status precise: exit is not specially hidden, and getting the money is not complicated for the sake of secrecy.
7. "Dictatorships are inevitable": a comparison with what works now¶
The architect's thesis after the broadcast: the count is opaque, public-sector workers will outvote, the majority will endure, the only way out is through hunger and empty shelves. The first version of this section objected: double entry protects an adopted protocol, and a regime that controls the count also controls the treasury. The architect's correction: "so let them control the fact that 80–90 % took the money. Autocracies want to show that elections are lawful — but if 90 % did not come, how do they paint turnout? For an autocracy any current method is barely effective, and the protocol too, but at least somehow." The correction is accepted: the objection measured the protocol against a tool that does not exist.
| Method | What it yields under autocracy |
|---|---|
| Boycott | Dries up turnout and eases the dependent electorate's victory (056d.1) |
| Voting for the "lesser evil" | Legitimises; the vote goes to those who will vote as told |
| Spoiling the ballot | The percentage is counted from valid ballots |
| Observation and a parallel count | Records but does not stop: in Belarus in 2020 forgery was proven at almost 300 stations, the result did not change (048i.2) |
| The protocol as a demand | A non-political question nobody can be jailed for (048e.4); the fork "forbid — take money from your own core, allow — lose turnout" (056d.3) |
| The protocol, if adopted | Turnout cannot be painted: 80–90 % received money and a bank notification, the total paid is a budget line; what remains to paint is only the content of a small pool's ballots |
What is left to the regime. Not adopt — and explain why people may not receive their money. Adopt a fake with commissions and delays (042, 059e.3). Or adopt and present the mass exit as trust ("the people are so calm they took the dividend") while painting the content of the remaining ballots. The third is the most likely, and the link with 048i works against it: the pool has shrunk to the motivated, and the motivated readily present tokens. The 2020 parallel count covered less than a tenth of those who voted; in a pool of the 10–20 % most motivated the coverage can become a majority, and the lower bounds will begin to overlap the official figures. After that the regime is left with naked force — and that is the subject of 048d.
The elite channel is not an alternative but a continuation. Autocrats most often lose power not to hunger or uprising but to their own entourage: by Svolik's data on dictatorships of 1946–2008, removal by insiders is the most frequent cause of exit, well ahead of popular uprisings. The first version of this section concluded from this that the working channel is the elite's calculation "rather than" the electoral one. The architect's correction: "it is easier for the elites if it is plainly visible that the autocrat is naked and has no support; they will certainly get the secret protocols of who took the money." The correction is accepted: this is one chain, not two. An autocrat's main asset before his own entourage is the appearance of mass support; the literature on electoral autocracies explains inflated results exactly so — not for the sake of winning but as a signal of invincibility that keeps insiders from defecting. Each of them does not know what the others think, and believes the figure. The protocol takes that signal away: the number who took the money is not propaganda but a line in the treasury and the banking system, and the first to see it are precisely those who sit on those flows. Turnout can still be painted for television; it cannot be painted for the finance minister who signed the payments. Then 048d.6 takes over: when the entourage knows the king is naked, a golden parachute becomes more rational than loyalty.
Both channels are described in the repository as models without precedent — and that remains so; adoption of the protocol by an autocracy is still the narrowest spot (057b.5, 056d.8), but a narrow spot is not the same as "does not work".
8. Weak point of the section¶
In their first version §6 and §7 repeated the error analysed in 037b.4: comparison with the ideal instead of comparison with the system in force — in §6 with a receipt-free abstention, in §7 with a tool that would work under a consolidated autocracy. After the correction what remains is not a hole but a limitation: the relative weight of a removed vote in a shrunken pool and the unmeasured size of the circle "dependent, yet motivated". The estimates in §4 come from different countries and years and do not add up to an overall share of the coerced; they also cut both ways — they confirm that coercion exists now, that is, that the comparison must be made with it rather than with its absence. And §7 rests on Svolik's general conclusion without verification of the exact figures. 🟡
Related: 048i (three channels and a parallel count — a development of §3) · 048f (double entry; 048f.3.3 — the clarification on open voting) · 056d.4 (the price of coercion) · 039b.3.3 (household coercion) · 057b.3 (negative vote buying, pilot requirements) · 033c.4 (publicity of status) · 059d.5 (the floor price of a vote) · 019b, 040c.1.5 (the price for the poor) · 048d, 048e (autocracy) · 042 (poison pills) · 013c.3 (chokepoints)