The poll

T2 shipped the ballot as a sealed container: you could see who had voted, never what anyone chose, and no count existed anywhere until it fired. That was right about the danger and wrong about the experience — the card told you almost nothing. This page is the redesign（owner brief 2026-07-22, from a WhatsApp reference）, its one new rule, and what shipped. shipped v570 · 2026-07-22 five edits v571 review pass v572 the editor page v573

1 · Why the sealed card was not enough

T2's ballot was a roster strip: the question, the option pills, a row of faces with ✓ or blank, and n/m. Correct, and nearly mute. It never said whose poll this was, it showed the same nothing before and after you voted, and the only place a result ever appeared was a one-line capsule after the fire. The owner's brief, drawn as a mockup:

(avatar) Newton started a Poll
------------------------------------------
Next vacation location:
Santorini (avatar of Dan) (avatar of Bob) +
*****
Lake Como (avatar of Mary)
*****************

waiting for (avatar of Tom) (avatar of Cy)+
------------------------------------------

Three separate asks live in that sketch, and only the third collided with anything: attribution（whose move this is）, a waiting-for row（who is still out）, and voters' faces on the option they picked — which is a live tally, and a live tally is what T2 was built to prevent. The reveal gate is what let all three ship without retiring the ruling.

2 · The card

3 · The reveal gate, precisely

The whole rule is one branch in gate_payload(viewer_uid):

if mine:                          # …and only now, the standings
    out["counts"] = counts
    if not g.get("anon"):
        out["by_opt"] = by_opt

Three consequences worth stating out loud, because each one is a way this could have been built wrong:

• The server withholds; the client does not hide. A viewer who has not voted is never sent a count. Had the payload carried the tally and the CSS declined to paint it, devtools would read the poll — and it would have broken the read-path law（hidden content becomes visible only at reveal, by construction, never by a flag）. Verified on the wire: a non-voter's /gate response reads …"need":[7,8],"in":[7],"mine_ii":[] and stops. Amy's vote is in in（WHO）and nowhere else（never WHAT）.
• ⚠ The gate SSE is viewer-LESS, so it can only ever carry the un-revealed shape. One payload fans out to a whole room and only some of them have earned the numbers. Every publish site calls gate_payload() with no argument, which makes the broadcast safe by construction. The tapper's own standings ride their tap response; every other voter re-reads GET /api/rooms/{id}/gate when a broadcast lands. This is the same house pattern T3 uses for a dealt card（「MY card never rides a broadcast at all」）.
• Anon reveals counts and never a map. by_opt is omitted entirely, so an anonymous poll shows bars and numbers to a voter and zero faces to anyone, ever.

4 · Multi-choice

<vote options="Fri, Sat, Sun" multi/>（the room's language: 「周五, 周六, 周日」）· a pick more than one toggle in the T4 drawer beside 匿名（the parity law: whatever a persona can arm, a guest can arm）.

Uncommitted ticks are not state: they live in one client-side variable, they are dropped by a reload or a room switch, and while you are wandering over the options the counts stay dashes. Nothing is revealed by considering a vote.

5 · The calls, and the one thing deliberately absent

• No leader star. The WhatsApp reference stars the top option; the owner's own mockup did not, and it is the one element that would cross the boundary law — the server states counts, and what wins is the room's agreed rule, never the renderer's arithmetic. Options stay in option order, never re-sorted into a ranking.
• A VOTE IS FINAL（owner ruling, v571 — this reversed the v570 default）. The reveal gate hands you the standings the moment you commit, so a revision would be a move made on information the first voter never had: the anchoring the gate exists to prevent, arriving one step later. Locking makes every vote in a poll equally uninformed, which is the whole property worth having. Refused server-side, not merely greyed in the UI — and re-submitting the same set stays an idempotent no-op, because a client retry must never read as a change. Once yours is in, the rows stop being controls: single-choice and multi alike.
• An empty submission is refused, not treated as a withdrawal. Membership of subs is what「has voted」means, and the reveal gate reads it; a person who could un-vote could read the standings and leave no trace of having done so.
• A single-choice ballot keeps only the first index of a submitted set — a stale client cannot smuggle three picks onto a one-pick poll.
• Both request bodies are accepted（{options: […]} and v569's {option: i}）, because a service-worker-cached shell keeps voting through a deploy.
• The opener line went to the sealed circle too（「X started a round」）. The ask was about the poll; the reason generalises — an unattributed card reads as the room's own furniture appearing by itself.

6 · The five edits（v571）

Owner review of v570, same day. Two of them turned out to be one rule; one was a bug I had shipped.

7 · The review pass（v572）

Owner review of v571. Two of the six were the same bug wearing two faces, and one is not fixed — said so below rather than guessed at.

8 · The editor page（v573）

The rest of the pass moved the guest's editor out of the tool drawer. A poll has a question, a list that grows, an order, and two switches — more than a row in a sheet can hold — so 「Create poll」（renamed from 「Start a vote」）now opens a page, sliding in from the right on the .fwd-page rails with ‹ back as its dismissal（the PAGE type）. Two habits copied from WhatsApp's, both load-bearing:

• The option list adds its own next field. Fill the last one and an empty one appears; empty the tail and the spare collapses back. You never go hunting for「+ add」, and the list can never be left with two blanks at the bottom.
• Every option carries a grip. Drag reorders — and touch-action:none sits on the grip alone, so dragging a caret inside a field never moves the option.

ONE draft object is the truth; the DOM is a view of it. A reorder is an array splice followed by a repaint — not a pile of node moves that then disagree with what gets posted. Leaving with anything typed asks first（「Leave poll? Your edits won't be saved.」）, because the page holds work nothing else will remember. Anonymous joins Allow multiple answers, and a Who votes row defaults to everyone — an untouched picker sends nothing at all, and the server reads that as the whole room, so the common case costs zero taps.

Also: the count bar's fill keeps the coral hue and loses the shout（48%, and 72% for the option you picked）. At full strength a column of bars read as a warning rather than a count.

9 · Status

Verified（two minted users + Tess on :8011, then at paint level on 375×812）: a non-voter's card shows「—」on every option with empty bars and no faces while another member has already voted — and the wire proves it, not the CSS; the tapper's reveal arrives in their own tap response; a multi commit lands a set and the counts then sum past the people; an anon poll reveals numbers and zero faces; a reload restores opener, ticks, counts, bars, faces and the waiting row; a cached v569 body still votes. v571 adds: a change refused server-side while the same set stays an idempotent no-op; the live card's transform measured none throughout a tap and its SSE round trip（no flinch）; an 86-character option wrapping to three lines instead of ellipsing; and a closed poll rendering as an inert full card — rows as <div>, counts, bars, faces, lock line, still tappable for the who-voted sheet — with zero one-line capsules left anywhere. python lib/smoketest.py → SMOKE: PASS（666 checks incl. 14 new）; i18n_audit clean.