How the record proves itself.

1 · The seal — criteria are hashed, then frozen

When a call is sealed we canonicalize its statement, resolution criteria, deadline and source, and store the sha-256 of that exact text on the receipt. The database refuses updates to any of those fields once sealed (a trigger, not a promise). If anyone edited a sealed call anyway, its stored hash would no longer match its content — which is exactly what the live check above recomputes.

// the canonical serialization (lib/seal.ts — key order is law)
JSON.stringify({
  statement, criteria: [...], // trimmed
  deadline,                   // ISO UTC
  source,                     // url or null
})
// criteria_hash = sha256(canonical json)

2 · The consensus — published math, honest tiers

The crowd number is an unweighted log-odds pool: each forecaster’s probability p becomes log(p / (100 − p)); the pool is the mean, mapped back through the logistic. No extremization (α = 1.0) at this stage. It is only shown from n ≥ 5 forecasters — below that you see the author’s own sealed number, labeled as such. The n is always displayed. Consensus weight is never for sale and points do not affect it.

3 · The points ledger — append-only, hash-chained

Points are play-money (free, non-cashable, never purchasable) and every movement is one signed row: kind, amount, balance-after, and a sha-256 over the row’s content plus the previous row’s hash — a per-account chain, like a tiny blockchain without the ceremony. Editing or deleting any historical row breaks every hash after it. The database additionally rejects UPDATE and DELETE on the ledger outright. Settlement is parimutuel: winners split the losers’ stakes pro-rata; there is no house, no rake, and no way to buy an advantage.

4 · Forecasts — your first number is kept

You may update a forecast until the deadline, but your first probability is stored immutably and every update is logged with its timestamp. Scoring (arriving with the Record) uses the mean of your first and final Brier scores — so late piling-on can’t launder a bad early call, and the update trail is part of the public record.

What we cannot prove — said plainly

Resolution of human-judged calls is operator work. What binds us: the sealed criteria (hash above), the public settlement transcript with its source on every resolved call, the report button on every permalink, and a 48-hour review commitment. Auto-resolvable calls (weather, FX) cite their data source in the criteria so you can check the settlement against the same source we used.