Section 9: A Count Anyone Can Repeat - Deep Dive: Tallying, Ranked Choice & Verifiability

Executive Summary: Voting closes, and the system's job changes from forgetting to proving. This section covers the close sequence, a deterministic tally job under its own read-only role, a full instant-runoff example over Northfield University's 30,000 ballots in which the first-round leader loses, and verifiability: tracking codes on a bulletin board, published anonymized cast vote records (CVRs), open tabulation code and small-cell suppression. The count takes milliseconds. The hard part is making it correct, reproducible and checkable without a receipt that could be sold.

The interviewer looks at the clock. "Voting closes at the end of the 72 hours. Walk me from that moment to a result people believe."

You: "Close it cleanly, count it in a way anyone can repeat, then publish enough that nobody has to trust us. The count includes ranked choice for president, so I'll do that arithmetic on the board."

Closing the Election

The rule is simple to state: a ballot counts if its cast transaction began before closes_at. Revoking grants at the close instant isn't enough, because a cast already in flight would still commit afterward. So each cast takes a share lock on the election row (SELECT … FOR SHARE where status = 'Open'). At close, the close job runs UPDATE … SET status = 'Closed', which waits for every in-flight cast to commit; after that, no cast can find an open election. Only then does the flusher, which normally waits for at least 25 ballots, move whatever remains, shuffled together with the previous batch so no batch is smaller than 25. Section 10 owns the last-second case.

Before counting, a close-check job whose role can count rows but not read selections (through a count-only view or function) checks totals that reveal nothing about content:

• COUNT(ballots) equals COUNT(participation) for the election: 30,000 and 30,000.
• For each ballot style (about 32), ballots equal participation joined to the frozen roll's style.
• Codes on the bulletin board equal ballots: 30,000.

A mismatch stops publication and pages the election committee. Checks plus count fit easily inside the 30-minute results target.