PLN BOX SHOW RIG · verification

Digital pack, provably fair: 1. Before any pull, the platform publishes serverSeedHash = SHA256(serverSeed). It is on camera all episode. 2. Every pull uses hmac = HMAC_SHA256(key = serverSeed, message = clientSeed + ":" + nonce). 3. roll = first 8 hex chars of hmac / 0xFFFFFFFF. The roll walks the box's published cumulative odds table to pick the item. 4. When the episode settles, the platform reveals serverSeed. This page rechecks SHA256(serverSeed) against the pre-committed hash, then recomputes every pull. Physical pack, custody chain: 1. Every custody event (product shown, seal broken, card logged, pack closed, attestation) is hashed with the hash of the one before it: hash = SHA256(JSON.stringify([seq, at, kind, detail, prev])). 2. This page recomputes every hash in your browser and confirms each entry still links to the one before it. That alone only shows the record is internally consistent, and this page says so plainly rather than calling it verified. 3. A card's own entry does not carry the card: it carries a hiding commitment, commitment = SHA256(JSON.stringify([salt, tier, name, comp])), written the instant the card is logged, before the pack it came from is even queued to air. The salt and the card stay off the chain, off every payload, until the pack is revealed, at which point an opening entry publishes them. This page recomputes the commitment from each opening and checks it against the commitment its card entry recorded, shown per entry below. 4. The custody head airs on the broadcast at settlement, on the fairness strip. Paste the value you read off the screen into the box below to anchor the check against it: this page never fills that box in from its own computed head, since comparing a chain to a head computed from that same chain is not a check. The anchor is what catches a chain that was truncated or replaced outright, since either would still look internally consistent on its own without it. THE BREAK, case allocation, one rule and two separate checks: 1. Before the draw, the platform binds the episode to a drand round that has not happened yet, and publishes commitment = SHA256(JSON.stringify([buyers, spots, {chain, round}])), with the full buyer list, the spot list and the round number airing alongside it. An episode drawn before the beacon existed committed to the two part form, SHA256(JSON.stringify([buyers, spots])), and this page recomputes whichever form that episode actually committed to, which its own payload says. 2. The draw itself is one rule, and this is the whole of it: the buyer list is shuffled, the team list is shuffled, and the teams are then dealt out one at a time around the table in that shuffled buyer order, the way a dealer deals cards. Nobody picks a team, and nobody picks who deals first. 3. For a break bound to a drand round, the seed that shuffle runs on is not the show's to choose: clientSeed = SHA256("pln-beacon:" + commitment + ":" + chain + ":" + round + ":" + randomness), where commitment is the hash from step 1, the one that aired on the commitment card, and randomness is the 32 bytes drand's own network published for that round, after that commitment had already aired. Every input to that seed is covered by the hash that aired, which is the rule that makes this worth anything: a value in there that the audience never saw would be a value the show could try over and over in private until it liked the draw, and then air an unchanged commitment beside it. This page verifies that round's BLS signature against drand's published chain key in your browser, using a vendored copy of @noble/curves served from this origin, and it fetches the same round from api.drand.sh as a second opinion. The signature is the proof; the fetch is a sanity check. A break drawn before the beacon existed has no round to check, and this page says so rather than showing a check it never ran. 4. At settlement the platform reveals the server seed, the draw's fourth input and the house's own value, held rather than aired. This page rechecks it too, against serverSeedHash, pre-committed at wallet creation before the round existed and aired on the fairness strip from the start of the episode: a server seed that does not hash to that value was never the value pinned before the draw, whatever it recomputes cleanly against. This page also rechecks the commitment, then recomputes the same shuffle the draw ran, keyed on SHA256(serverSeed + ":alloc:" + commitment), and checks the result against bySpot, order and byBuyer alike: the board's TEAMS column reads byBuyer and the on air ceremony reads order, so a check of bySpot alone cannot catch either being tampered on its own. 5. The commitment hash airs on the commitment card, in front of the audience, before anything is drawn. Paste the value you read off the screen into the box below to anchor the check against it, exactly as you would the custody head above: every other check in the allocation section recomputes this payload against itself, and a payload replaced whole recomputes against itself perfectly. The aired hash is the one value on this page that did not come from this page, and since the seed above is keyed on it, it is what the rest of the claim hangs from. 6. That is the whole allocation claim, and it says nothing about what came out of the packs the case dealt. Those packs are digital pulls in their own right: the platform reveals a seed for them exactly as it does for any digital pack, and this page recomputes them the same way, shown below the allocation on this page as its own, separately badged check.