What Leaves No Trace: Completeness of the Participant Set in Collective Decision-Making

Abstract Collective decision procedures can prove that the responses they count belong to authorised subjects and that the result is computed correctly. They cannot prove that every required response has been counted. This paper isolates completeness of the participant set as a requirement that is logically independent of the two properties it is commonly conflated with — anonymity of participation and confidentiality of content — and that follows from neither. A criterion of assessment follows: a tool that verifies authenticity does not thereby guarantee completeness of coverage, and substituting one notion for the other is a systematic methodological error rather than a local technical oversight. Its subject is collective decision-making in general — allocation of resources across units, agreement on priorities, eliciting what a group knows but has not entered into any common register; voting procedures are taken as the best-studied special case and a source of examples. The work rests on four primary sources, read in the original — Benaloh and Tuinstra (1994), Juels, Catalano and Jakobsson (2005), Kiayias and Yung (2002), Küsters et al. (2020) — and on an industry survey of twelve private-voting protocols (2026). From these follows the observation the paper builds on: concealment of participation and public handling of the roster are not combined in any existing scheme. Where participation is hidden, the roster is not verified; where the roster is processed publicly, participation is thereby visible. Of the twenty-six criteria in the survey’s evaluation grid, not one asks which roster everything else is checked against. The requirement divides in two. One part is provable: the participant set is closed before the start and does not change thereafter, and the responses counted are as many and from the same subjects — and this can in principle be proven without disclosing their number. The other remains an assumption: that the closed participant set is everyone the decision concerns; it cannot be checked from inside the procedure. The schemes examined here are provable, and so are the gaps and limitations within them: these are named by their own authors and visible in the composition of the evaluation grids. The present work sets out the layer in which one of those gaps — completeness of the set — becomes solvable, and names the one thing still missing for its solution. What has been built is listed in a self-assessment table across layers L0–L5: the participant set is fixed when the session opens and does not change until the result is announced, membership of it is proven without naming the participant, the distribution of choices is closed until the moment of recording, and an omission in the record shows up as a break. Of the table’s twelve rows, ten are closed. The eleventh is the thing that is missing, and it is named in the singular: a proof of set equality verifiable by a third party without disclosing figures — a primitive that none of the schemes examined possesses, and for which the industry survey’s evaluation grid does not even carry the question, so that the shortfall belongs to the field rather than to this architecture. The twelfth is closed by a component on which the architecture relies. The author is the developer of the architecture on which the limited test case is examined; this work is not an independent evaluation of it. Keywords: participant set completeness; collective decision-making; coercion-resistance; forced abstention; receipt-freeness; tally-hiding; running tally privacy; fixation of the participant set; universal verifiability; zero-knowledge proofs; DAO governance; BeTrueCore