What an unconfirmed transaction with the highest bid count as a valid bid, or does it have to confirm before it counts? Would be good to have clear rules on that.
Yes, unconfirmed transactions count as bids as soon as they are broadcasted: the time considered for the auction is the "Received time" you can see on blockchain explorers. Just as an example, this specific transaction would be counted as a bid placed on: 2016-06-21 20:37:39
https://blockchain.info/tx/ef330638e69f08504f04709e8237bab69eac5c554228b8ad86925af5b7a119e6Then the prize is paid to the winner as soon as all the bids included in the jackpot have 3 confirmations.