# How holder votes work (fast rules)

Draft. These rules are frozen before any ballot opens and apply to QIP-1 and later proposals until a vote adopts a replacement. They replace the earlier draft charter's 72-hour vote, 48-hour challenge period and closing snapshot.

## In short

Votes signal a preference. They do not execute themselves and give holders no right to move reserve funds. A vote can ask for changes existing code already allows, such as opening input, which models seats can use, compute experiments or session timing. OPS's 40% share of ordinary claims, creator fees and marketing spend are outside voting. When a proposal passes, the team publishes execution receipts or a specific refusal, and passage cannot bypass funding, implementation, accounting, provider or reserve checks.

A vote takes 18 hours from opening to the earliest final result: 6 hours of voting, 6 hours for objections to the count, 6 hours to check the proofs. The first proposals, published before 1 November 2026, run in a shorter bootstrap class: 2 hours of voting, 1 hour for objections and 1 hour to check the proofs, 4 hours in all. The count is published when voting closes, and the result takes effect only after the proof check. The windows are short so the first decisions can take effect within a day of opening, while the rules are new and caps are small; from 1 November every proposal uses 6, 6 and 6 hours again. Time alone never finalizes a count. An unresolved objection or a failed evidence check holds the result until it is resolved.

Voting weight is liquid QUOTUM plus attributable staked QUOTUM, including queued stakes, counted once, read at the snapshot block B. B is the latest finalized block before the proposal is published, so nobody can buy weight after reading the proposal. Moving tokens after B does not change a ballot's weight. Buying before B can still capture weight, and addresses are not people. OPS on seat 1 is the only team wallet left out. Protocol accounts do not vote, and tokens held in pools give no one voting weight. Every other eligible wallet votes as an ordinary holder, without labels.

You vote by signing a message on quotum.org/governance. It is not a transaction and never grants a token approval, allowance, transfer or claim. Under these rules only ordinary addresses with no code at B can vote. App wallets that use EIP-7702 delegation, such as FOMO, and contract wallets such as Safe cannot vote yet. Support for delegated addresses is planned for the next version of these rules. You can replace your ballot before voting closes with a higher nonce. The highest valid uncontested nonce counts.

A proposal passes when For weight exceeds Against weight, ballots across For, Against and Abstain carry at least 1% of supply at B, and at least five distinct eligible addresses with positive weight have a counted ballot. A tie fails. Large holders can decide the result. Ballots, receipts and the full tally are published so anyone can recount. Two transactions on chain 4663 record the hashes of the signed receipt log and the tally: one after voting closes, one with the final result, even when the tally did not change.

Several proposals can run at once. Each has its own ballot, receipts, tally and result. Proposals published together share one B. A ballot for one proposal never counts for another.

Anyone can post a draft for discussion. To go to a vote, a proposal needs sponsors with eligible weight of at least 0.25% of supply at its B. The first proposals, QIP-1 to QIP-4 when first published before 1 November 2026, are sponsored by the team from seat 1. OPS's weight still counts in no vote.

## Exact rules

These rules are the charter itself. If anything above reads differently, these rules apply.

### Proposals and publication

Anyone may submit a draft for discussion in its public discussion thread. Sponsorship requires eligible weight of at least `ceil(totalSupplyWei/400)` at that proposal's B, verified before voting opens. Bootstrap-class proposals QIP-1 to QIP-4, first published before 2026-11-01T00:00:00Z, are the team-sponsored exception: the team sponsors them from seat 1, whose stake of at least 2,500,000 QUOTUM clears the line. Sponsorship gives no voting weight; OPS stays excluded from outcome, quorum and participating addresses.

A proposal states its action, funding, implementation limits, stops and expiry. Publication freezes the proposal bytes and hash. B is the latest finalized block on chain 4663 strictly before publication, with its hash agreed by two independently run readers. The ledger at B, exclusions as applied and account evidence are assembled after B, independently reproduced and published with their hashes before voting opens. B's header timestamp and the first public publication of the proposal must each be at least two hours before V. Proposals published as one bundle share one B; each still has its own package and manifest hash. A changed proposal, an incorrect B, a missing reconciliation or unresolved evidence delays opening and requires a reviewed replacement package. Earlier versions are preserved.

The venue is quotum.org/governance, with own gasless EIP-712 ballots and a public deterministic tally. Discussion uses one public discussion thread per proposal, linked from the proposal's page; X links only, no forum.

### Schedule

V is the package's explicit opening time. The package commits its class and its three durations: voting v, objections o and proof check p. The standard class is v = o = p = 6h. The bootstrap class, for proposals first published before 2026-11-01T00:00:00Z, is v = 2h, o = 1h, p = 1h; quorum, thresholds, the address minimum and every other rule are the same in both classes. D = V+v. Ballots are accepted on `[V,D)`; every signed deadline equals D. The close tally is published at D. Count objections are accepted on `[D,D+o)`. Proofs are checked on `[D+o,D+o+p)`. The final result is eligible from Fmin = D+o+p, only after every objection has a published decision, the final checkpoint is independently verified and the B checks pass. F is the timestamp of the actual published final result, and every activation window measured as F+2h or F+168h uses that actual F, not the close tally or Fmin. There is no early decision and no late ballot.

### Snapshot and weights

Eligible weight is liquid QUOTUM plus attributable staked QUOTUM at B, including queued stakes. Count tokens once; staking escrow is replaced by attributable stake. Pool balances are not attributed to individual voters. Use raw token units and totalSupplyWei at B without subtracting exclusions. Quorum is `ceil(totalSupplyWei/100)`. No wallet cap or square-root weighting. There is no closing snapshot: weight is the B read for the whole vote.

OPS (seat 1), `0xc1fe2404fec25d6a905e67bb60cddae95fee2741`, is the only team exclusion from outcome, quorum and participating addresses, covering liquid and attributable stake. Valid OPS ballots are kept as diagnostics and never affect the result. Protocol contracts, zero/dead accounts, sink, staking escrow as an account, curve, pools, PoolManager and manifest-listed protocol contracts are separate nonvoters. No retroactive exclusion of a losing voter.

### Ballot integrity

Freeze the complete EIP-712 schema and verifier with the proposal: domain `quotum-FAST-ballot-v1`, chain ID 4663, primary type, field types, choice mapping and exact origin `https://quotum.org/governance`. Bind voter, manifest hash, token/staking addresses, proposal hash, B number and hash, choice, deadline and uint256 nonce. A ballot for one manifest is invalid for every other manifest, including rehearsal packages.

Account policy `eoa-only-v1`. Classify every ledger address by its code at B, read in two separately run collections and compared byte for byte. Only empty code is admitted. EIP-7702 delegated addresses and any other code cannot vote. Authentication is an ECDSA signature over the frozen typed data that recovers to the voter address. The page produces a raw 65-byte signature; the verifier also accepts the same signature in structured form, and in both cases it must recover the voter.

The collector accepts a ballot only when it records receipt on `[V,D)` with every field matching the package. It keeps one append-only receipt log per proposal, signs its head with a published Ed25519 key, and an independent custodian mirrors and recounts it at least every 15 minutes and at D. Save your signed acceptance receipt: a ballot without one is not proof of collection.

For each voter, use the highest valid uncontested nonce received in the window. Identical ballots at one nonce are duplicates. Different valid ballots at one nonce invalidate that nonce; the next lower uncontested valid nonce counts. With none remaining, no ballot counts.

The B hash is re-checked by both readers, each recording the B hash and a finalized height at or above B, in the five minutes before V, between one hour and one hour five minutes after V, in the first five minutes after D and within five minutes before each anchor. On a mismatch the operator stops collection and publishes a collector-signed notice, no anchor is sent, and the proposal is rebuilt with a new B, a new V and new ballots.

### Objections and anchors

Anyone may object to the count on `[D,D+o)` through the published route, with evidence: a signed acceptance receipt for an omitted ballot, a conflicting nonce, an inconsistent log head or incorrect arithmetic. Objections may correct timely received records. They never add late ballots or reopen voting. Every objection gets a published decision and reason, with Fmin as the target; any unresolved decision delays publication of the actual final result F beyond Fmin, and the final review is completed and recorded before that result is published. Under these rules an accepted correction blocks the final result until a separately reviewed, reproducible correction process exists. No objection is rejected to reach a result.

After D, one zero-value transaction from the published anchor wallet to itself on chain 4663 records the close prefix, the proposal hash and SHA-256 hashes of the signed receipt-log head and close tally. At or after F, after every gate passes, a second transaction records the final prefix and the hashes of the final head and final tally, even when the tally is unchanged. With several proposals, anchors are sent one at a time. The anchor wallet is an ordinary account distinct from the keeper signer and OPS, funded only for gas. Anchors identify published files; they do not establish a correct count or authorize activation. The finalization endpoint supplies the count evidence; the final record is complete only when the operator has also published the passing B checks and both verified anchors.

### Passing a proposal

After exclusions and objections, For must exceed Against, participation across For, Against and Abstain must reach quorum, and at least five unique eligible positive-weight voters must have a counted ballot. Abstain counts for quorum and addresses only. Ties or any failed condition leave policy unchanged. Publish the largest-voter and top-three weight shares with the result.

### Voting scope and execution

Votes may signal bounded reserve and protocol priorities feasible in existing code, including opening-input policy, provider-supported models, compute experiments and session scheduling. The immutable sink has no general treasury transfer route. The $50 ceiling, 0.25% supply-value bound and payout destinations have no v1 setters. No arbitrary reserve transfers, holder fee sharing, redemption, voter compensation or holder payments are permitted. Uplift creates no extra OPS claim.

A proposal may instead be a direction signal: it asks whether holders support a direction and its principles for work that does not exist yet. A direction signal authorizes nothing. It moves no funds, deploys no contract, issues no token, changes no published promise and creates no claim, return or payment for anyone. Implementing a supported direction needs its own later proposal with exact rules, under this charter. A direction signal is labelled as one in its title.

The team publishes execution receipts or a specific refusal. Passage cannot bypass funding, implementation, accounting, provider or reserve checks. A material defect in a package blocks activation and requires a new frozen ballot.