Layer 1: a bet with a clock

What the poll decides decided

A Smart Poll has options, a max_bet — the most one account may ever hold in it — and a duration_minutes. Stakes go in while it is open. When it closes, the option holding the most credits is the recorded answer. Head count is used only to break an exact tie in credits. There is no oracle: nothing outside the poll is consulted, and nothing outside it can overrule the pot.

What that answer is: one row in pool_settlements, read by the payout path and shown on the category page as the settled outcome. What it is not: truth, a name on the map, a position, or brightness. See R10.

No way out decided

Once a stake is in, it stays until the poll closes. There is no withdraw, no sell, no cancel. Someone who filled the ceiling early is never refunded and never forced out; they simply cannot add. That is the intent: early conviction counts, late sniping does not. The only paths that return a stake are the refund paths of R8 and R9, and those return everyone's, together.

The stake ceiling decided

place_bet never reads max_bet itself. It asks one function, stake_ceiling(post_id), how much one account may hold in this poll right now, and refuses the stake if the account's existing holding plus the new amount would exceed it. The holding is counted across every option of the poll, so tapping Bet ten times cannot beat the cap. The balance row is locked before the check, which closed a race where one account could pass the ceiling by staking from two sessions at once (fix 20260910000100).

stake_ceiling is least(decay, concentration): the time curve of R4 and the concentration cap of R6, whichever is smaller. A vote-only post carries max_bet = 0, and the same function returns 0 for it, so a vote-only poll accepts no stake by the same rule and not by a separate one.

The curve decided

Let f be the fraction of the poll's life that has elapsed: 0 at open, 1 at close, clamped. The ceiling is floor(max_bet × weight(f)). Two weights exist, and they are the same parabola — what differs is when it starts. Immediate: 1 − f², full at the open and falling away faster the longer the poll runs. Delayed: 1 while f ≤ 0.25, then 1 − ((f − 0.25) / 0.75)² — that same curve, held flat for a quarter and then compressed into the three quarters that remain.

Corrected 30 September 2026 (decision 95). Until today this page and the code described the immediate curve as (1 − f)². That is a parabola too, but the opposite one: its vertex sits at the close, so it surrenders most of the ceiling in the poll's first moments and then runs nearly flat along the bottom — moving from three quarters elapsed to the close would cost an account almost nothing. A ceiling exists to make waiting expensive, so the penalty has to grow as the close approaches, and that curve is 1 − f². The delayed curve always had the right shape, as does the quarterly grade allowance (grade_ceiling_weight), which is flat for half a quarter and then falls on the same parabola; the immediate curve was the only one in the codebase shaped the other way. The flag-driven quadratic branch still computes the old shape in live code — it is switched off in production and has never run a poll — and the drafted per-poll migration now carries the corrected one.

Today the curve is picked by two global flags. In production quadraticDecay = false and quadraticDecayDelayed = true, so every poll runs the delayed curve. The code's own defaults are the opposite (quadratic: true), which is one reason R5 exists — and why the superseded shape still matters even though it is off: if the app_settings row went missing, both server and client would fall back to it. quadraticDecay is tested first, so if both were on the immediate curve would win; the SQL twin repeats that order on purpose, because if the two disagreed the screen would show one number and the server would enforce another.

Pinned values at max_bet 10,000, halfway through: immediate 7,500, delayed 8,888, none 10,000. One fifth of the way through: delayed 10,000 (still flat), immediate 9,600. Three quarters through, where the two sit furthest apart in credits: delayed 5,555, immediate 4,375.

The superseded curve carried a load-bearing quirk, and the correction retires it. The server wrote floor(max_bet * (1 − f) * (1 − f)) left to right and the client wrote the same, because folding it to max_bet * weight changed the last bit of a double on some fractions and floor() turned that into a whole credit — the screen offered 8,649 and the server refused it. Three comments say that happens on “42 of 101” sampled fractions; a re-run measured 9 of 101, and the test pins three (0.07, 0.14, 0.27). 1 − f² builds a weight and multiplies once, exactly like the delayed branch, so there is a single multiplication and no order to get wrong. The warning stays true of the live flag-driven function, which still holds the old form; the count in its comments is overstated (decision 63).

The curve becomes a per-poll choice decided the plan

Decided 28 September 2026: “i can see the immediate quadratic curve be useful as well as the delayed one, that needs to be an option in smart poll creation, but the default should be delayed.”

The draft (DRAFT_20260929000300, on disk, not applied) adds posts.decay_mode — immediate, delayed or none, default delayed — chosen when the poll is created and immutable once the first stake lands (a trigger refuses the change), so the rule cannot move under people who already staked. The 73 existing smart polls take the default, which is the curve they have run under since 10 September 2026, so nothing they do changes. A new pure function, bet_ceiling_for_mode(created_at, duration, max_bet, mode), computes the curve with no flag read; stake_ceiling keeps its identity and calls it, falling back to the flag-driven bet_ceiling only if the mode is somehow NULL, so the global flags become a fallback and stop being the rule. The migration's self-test pins 7,500 / 8,888 / 10,000 at f = 0.5, 9,600 / 10,000 at f = 0.2, 4,375 / 5,555 at f = 0.75, and that vote-only and closed polls still return 0. It also carries the corrected immediate curve and the renamed mode value, so applying it is what makes 1 − f² real; the client half — every screen that reads the flags, plus the two client copies of the superseded shape — is unbuilt (Q2).

The concentration cap decided

Decay is about time (late sniping). Concentration is about distribution (one account owning a pool). concentration_ceiling(seed_floor, pool, share_cap) = max(seed_floor, floor(share_cap × pool)), where the pool is counted before the new stake — deliberately conservative, since a holder's true share afterwards is strictly smaller. stake_ceiling takes the smaller of this and the decay ceiling; a NULL seed floor means no cap at all.

On Smart Polls it does nothing today: stake_seed_floor is NULL on all 73. That was chosen on purpose when it shipped, because 14 of the 15 positions open on 10 September 2026 would have been locked out of their own polls by a retroactive cap. Why it exists at all, measured that day: the average pool was 215 credits against a ceiling of 10,000, the largest account held 64% of its own pool, and polls averaged 1.6 stakers — a flat ceiling had never bound anything, and lowering it would not have either. The cap binds today only on governance grades (share cap 0.10; seed floors 100 federal, 50 state, 25 local), which are a different instrument with their own page.

One bet per person decided not enforced the plan

The rule, in his words: “we need to fix the 1 bet per user to enforce it, but there needs to be variable honestly, so users can maybe bet twice, once in the first half of the poll and once in the second half of the poll, but that needs to be able to change on a per poll basis.”

Today it is not enforced. The unique index on pool_bets is (post_id, user_id, option_idx) — one row per option — and place_bet tops a row up without limit (ON CONFLICT … amount + excluded.amount). So an account may sit on every option of one poll. Measured 28 September 2026: 21 user-poll pairs hold more than one bet, and all 21 are on both sides of the same poll. Under the payout rule of R1 a hedged account is in the winning and the losing pot at once.

The draft (DRAFT_20260929000200, on disk, not applied): posts.bet_windows, 1 to 4, default 1, set at publish and immutable once the first bet lands. 1 means one bet for the life of the poll; 2 means one per half. place_bet computes window_no = least(bet_windows, floor(f × bet_windows) + 1) and refuses a second bet in the same window with a message naming when the next window opens. A bet in a later window may be on a different option — that is the point: the second bet is how you change your mind, and the curve of R4 has already made it worth less. The unique key becomes (post_id, user_id, window_no), partial on rows dated after the migration, so the 21 historical hedges stay exactly as they are. Both sides in one window becomes impossible by construction. A poll with no duration has one window whatever bet_windows says. At 14 users this changes nothing visible except that hedging stops.

Settlement decided

A cron job (job 19, every five minutes, active) runs auto_settle_expired_polls: every smart poll past created_at + duration_minutes with no settlement row and no freeze, oldest first, 200 per run. It ranks the options by credits, then by bettors, and takes rank 1. An exact tie refunds everyone; otherwise it distributes. A frozen poll (under review for suspected cheating or system error) is never settled automatically — the whole point of freezing is that the money stops moving until a human decides. The kill switch is the flag autoSettleSmartPolls, which defaults to true when the key is missing. The manual path, settle_poll, has been used 0 times in 34 settlements; the fallback became the whole mechanism.

The fee. 3% of the stakes, in four parts (migration 20260605000000): 1.0% treasury, 1.0% notes, 0.5% locked, and 0.5% to the Investigator who authored the poll. When the author is Yon, revoked, or not an Investigator, that slice folds back into treasury, which then takes 1.5%. The total on bettors stays 3% in every case. On the refund path the fee is 0 and every bettor is credited the full stake.

Uncontested pools refund decided the plan

11 of the 19 distributions to date had every stake on one option. Nothing was decided, there was no losing pot to split, and a ~3% fee was booked against unanimity. The draft (DRAFT_20260929000100, on disk, not applied) adds one guard to auto_settle_expired_polls: if fewer than two options carry stake, refund instead of distribute. The refund path already credits each bettor the full stake and writes fee_amount = 0, so no new money code is needed. Applied to history it would have returned the fee on 11 of 19. The function's signature stays byte-identical, because the cron resolves it by name at first execution and an arity change would apply green and then throw where nobody is told.

The first version of this draft also added a three-bettor quorum. It was removed. By its own arithmetic it would have refunded 33 of 34 historical settlements, and with 10 lifetime bettors that is an off switch with a comment on it, not a floor. Neither comparable uses one: a market with one trade still resolves when the answer comes from outside, and tote pools subsidise thin markets rather than void them. The draft's own header says the cheaper, reversible move is the flag — autoSettleSmartPolls = false until a resolution source exists — and to reach for the migration only if auto-settle is staying on (Q5). One wart, cosmetic: the refund path marks the settlement is_tied = true with winning_option = 0, and an uncontested pool is unanimous, not tied (Q3). The money is right.

The wall, for this layer decided

Two things a poll's money may never touch. First, brightness on the map is never money. A settled poll counts as activity, which glows and fades over about a day; how much was staked in it moves nothing. Second, a poll's outcome is shown with the people% and the money% side by side, never collapsed — a whale can move money%, but cannot erase the people% beside it (docs/mission-roadmap-milestones.md, under “The WALL”).

The second is decided and not collected. Measured for the plan on 28 September 2026: 73 smart-market posts carry 3 free votes from 2 distinct voters; the smart-poll card (PollCard.tsx, 1,171 lines) never reads poll_votes — its option shares are pool shares. What the app calls people% on a consensus poll is a distinct-bettor count, which is money in disguise. There is no personhood-capped vote channel. Until there is, a Smart Poll card shows money, and this page says so rather than pretend otherwise.

Sybil is unsolved open

One bet per person is one bet per account, and every account is minted with 10,000 free credits. So every limit on this page is a speed bump, not a wall, until proof of personhood exists in design. Irrelevant on play money; decisive the day money is real.

What is actually built mostly built

See the ledger below. The curve, the ceiling, the cron and the fee split are live. The three drafts — uncontested refund, bet windows, per-poll decay mode — are on disk and not applied. The client half of R5 is unbuilt. One bet per person is not enforced.