# QIP-2 proposes a weekly max day at $50 per seat for two weeks

Draft. No ballot is open and no max day is active.

## In short

Each QUOTUM seat has an inference cap for the session, shared by the seat's keys. The contract sets it from measured input, roughly a day of net NVDA inflow into the sink, split across the seats at opening. Without QIP-1 caps have been a few dollars per seat. The sink also holds a reserve that the contract does not turn into caps on its own.

QIP-2 asks whether quotum should run one max day a week for two weeks: the session that opens Tuesday at 20:00 UTC and closes at Wednesday's 20:00 UTC bell gets a $50 cap per seat, the contract's ceiling, paid from the sink reserve. The cap is per seat and shared across that seat's keys, not $50 for every key.

At recent use most of a max day's cap would go unused. Unused cap buys and burns QUOTUM at the bell, so a max day is partly an inference test and partly a reserve-funded burn. Both are reported.

The vote signals a preference. It does not execute anything by itself. The team publishes execution receipts or a specific refusal, and passage cannot bypass the funding, accounting, provider or reserve checks.

## Why now

A seat's daily cap follows the previous day's inflow, so it is small on quiet days even while the reserve is large. A known weekly day with the full cap lets seats plan longer work, such as agent runs or batch jobs, and shows what seats do with more access before anything permanent is proposed.

In the filtered receipt sample for the 14 sessions closing 7 to 20 October, 46 of 90 seat-sessions with any use reached at least 95% of the cap, and sessions closing on Wednesday had the most of those. Caps in that period were a few dollars or less per seat, for example about $3.39 on 13 October and $0.84 on 19 October, so this shows seats running into small caps, not demand for $50. The weekday is a pilot choice, not a proven best one, and the $50 day has not been tested.

The pilot is two weeks, not four. The same reserve carries QIP-1 through the 4 November bell; two max days give a result at half the cost, and a longer run needs a new proposal with that result in hand.

## What changes

On each eligible max day, while the policy is active and every check passes, the keeper supplies `50 * N` USD to `TaxSink.open`, where N is its checked count of seats before open. The contract then sets the cap to $50 per seat unless the supply-value bound is lower. With 13 seats the opening input is $650. On days when measured input already gives $50 per seat, nothing changes.

## What to expect

Under QIP-1's $10 cap, 13 seats used about $26 and $47 of real inference in sessions 27 and 28, out of $130 each session. If use on a max day stays near that level, most of the $650 is not used and buys and burns QUOTUM at the Wednesday bell. That buy happens at a known time. The bell's existing price guard skips the buy if the pair is more than 10% above the day's average, and a skipped buy leaves the NVDA in the reserve.

## What stays the same

The $50 per-seat ceiling, the 0.25% supply-value bound and the claim, report and bell routes. OPS keeps 40% of ordinary claims, outside this vote, and the max day creates no extra OPS claim. Team seat 1 follows the same rules as every seat. There are no holder payments, returns, fee sharing or reserve transfers.

## Cost

Recognized use becomes provider debt, and unused cap buys and burns only where free NVDA, covered prices and the existing guards allow; failed or uncovered amounts stay in NVDA, so the cost and reserve examples assume unchanged seats and prices, no tighter supply-value bound and successful full settlement. At 13 seats one max day costs $650 and two cost $1,300. Seats that join after opening get the same cap, so 20 seats at the bell would make one max day $1,000.

The sink reserve was about $5,700 free on 24 October. Both possible max days fall while QIP-1 is active, and a max day replaces the $10 floor that day rather than adding to it, so at 13 seats the two max days cost $1,040 more than QIP-1 alone. With 13 seats, unchanged prices and inflow at its recent level, the reserve at the end of QIP-1 on 4 November would be about $3,500 with QIP-2, against about $4,540 without it.

## When it stops

Before each max day, free reserve must cover three things: a $2,000 buffer, $50 times the seat count for every max day still left in the pilot including this one, and, while QIP-1 is active, $10 times the seat count for every QIP-1 session still left that is not a max day. A max day never runs on money that QIP-1's remaining sessions need. With 13 seats, the first max day on 27 October needs $4,080 ($2,000 + $1,300 + $780 for six QIP-1 sessions), and the second on 3 November needs $2,650. Equality passes, and the check does not lock reserve funds. Stale price or reserve data, unresolved provider accounting, a provider shortfall or the team's emergency stop also end the max days.

If the check fails before the first max day, that week is skipped and the next Tuesday can still be the first max day. After the first max day, any failed check ends the pilot, and resuming needs a new proposal. A stop never cuts the cap of a session already open. Skipped weeks are not made up and do not extend the pilot.

## What is reported

After each max day the session record shows the seats, real use per seat, how many seats used more than $10, what burned, what was skipped or died, and the reserve after the bell. After the second candidate the team publishes a short review with these figures for both days next to an ordinary session, before anyone proposes more max days.

## How the vote works

Voting weight is liquid QUOTUM plus attributable staked QUOTUM, including queued stakes, counted once. It is read at snapshot block B, the latest finalized block before this proposal is published, so nobody can buy weight after reading it. OPS on seat 1 is the only team wallet left out. Protocol accounts do not vote, and tokens held in pools give no one voting weight.

Voting is a gasless signature on quotum.org/governance. It is not a transaction and approves or moves no tokens. Only ordinary addresses with no code at B can vote under the fast rules. App wallets that use EIP-7702 delegation, such as FOMO, and contract wallets such as Safe cannot vote on QIP-2. Support for delegated addresses is planned for the next version of the rules. QIP-2 passes if For weight exceeds Against weight, ballots across For, Against and Abstain carry at least 1% of supply at B, and at least five distinct eligible addresses with positive weight have a counted ballot.

QIP-2 is first published before 1 November 2026 and runs in the charter's bootstrap class: voting runs 2 hours, then 1 hour for objections to the count and 1 hour to check the proofs, so the earliest final result comes 4 hours after opening. The count is published when voting closes. Discussion runs in one public discussion thread linked from this page. The first max day is the first Tuesday 20:00 UTC opening at least 2 hours after the final result. The full voting rules are in the [charter](charter-fast.md).

## Words used below

- Session: one daily cycle, from open to the bell.
- Measured input: approximate-day net NVDA inflow into the sink, in USD.
- Max day: the session that opens Tuesday at 20:00 UTC and closes at Wednesday's 20:00 UTC bell, while this policy is active.
- N: the keeper's count of seats before it sends open.
- M: the number of max days left in the pilot, including the one being checked.
- K: the number of QIP-1 sessions left, including this one, that are not max days; zero when QIP-1 is not active.
- B: the snapshot block that fixes voting weight.
- OPS: the team wallet on seat 1.

## Exact rules

These rules are the proposal itself. If anything above reads differently, these rules apply.

### Ballot package

| Field | Value |
| --- | --- |
| Venue | quotum.org/governance, own gasless EIP-712 ballots and public deterministic tally |
| Ballot URL and discussion thread URL | https://quotum.org/governance#qip-2 and https://github.com/qvotvm/qip-1-receipts/issues/4 |
| B number, hash, totalSupplyWei, readable supply and quorum amount | in the ballot package: `snapshotBlock`, `snapshotHash`, `totalSupplyWei`; quorum is 1% of `totalSupplyWei`, rounded up |
| Frozen strategy, exclusions and reconciled ledger manifest | in the ballot package: `exclusions`, `ledgerSha256`, `ledgerManifestSha256` and the ledger-strategy artifact; the ledger is published with the package at quotum.org/governance/qip-2/ledger.json with the same hash |
| Proposal hash | `proposalHash` in the ballot package |
| Publication, voting, objection, proof-check, final and expiry UTC timestamps | in the ballot package and its publication record: `votingOpens` (V), `deadline` (D = V+2h), objections [D,D+1h), proof check [D+1h,D+2h), final eligible from D+2h; activation expiry F+168h |
| Collector identity and receipt proof/mirroring policy | collector Ed25519 public key `MCowBQYDK2VwAyEAetjCl1JO350n7s/Df/GIS9GOwd+DPE/cXLS+M61jVZM=` (DER SHA-256 `5d15f2b83a89b476dd3091388b69593d323f15d7755e970ba6315b0210549ce7`); independent mirror Ed25519 key with DER SHA-256 `0367d223ac5b79b8fe59b459aa90f4e912be08e70494ce4b1e7c4ad5e613df87`; mirroring and recount at least every 15 minutes, at D and at or after F |
| Anchor wallet address | `0xBbbC8F2aa7C59136AA630E2195c504907844C822`, an ordinary account funded only for gas, distinct from the keeper signer and OPS |
| Account policy | `eoa-only-v1`: only addresses with empty code at B, by ECDSA signature of the address's own key; EIP-7702 delegated addresses and any other code are not accepted; account evidence hashes are in the ballot package |
| Class | bootstrap (v = 2h, o = 1h, p = 1h); first publication before 2026-11-01T00:00:00Z |
| Sponsor | the team from seat 1, under the charter's bootstrap-class exception for QIP-1 to QIP-4; OPS's weight counts in no vote |
| Policy-build hash, reserve valuation, freshness and provider/accounting criteria | the policy-build document in the ballot package with its SHA-256 |

Ballots bind domain `quotum-FAST-ballot-v1` and chain ID 4663. Discussion uses one linked public discussion thread; X only links to it.

### Schedule and activation rules

B is the latest finalized block on chain 4663 strictly before this proposal is published, with its hash agreed by two independently run readers. B's header timestamp and the first public publication of this proposal must each be at least two hours before V. QIP-2 is in the charter's bootstrap class. Voting accepts receipts on `[V,D)` with D = V+2h, and the close tally is published at D. Count objections run on `[D,D+1h)` and proofs are checked on `[D+1h,D+2h)`. The final result F is eligible from D+2h after every objection has a published decision and all evidence gates pass.

The first candidate is the first session opening on a Tuesday at 20:00 UTC at least 2 hours after the actual final result F; it is always within F plus 168 hours. The second candidate is the Tuesday 20:00 UTC opening seven days later. The pilot covers these two candidates only, two max days at most. If the first candidate fails its check, the second candidate may still run and is then the first max day. If neither runs, approval expires after the second candidate. Skipped candidates are not made up and do not move the end. No renewal.

### Question

Should quotum run two weekly max days, each the session opening Tuesday at 20:00 UTC, where the keeper supplies `50 * N` USD as opening input to `TaxSink.open`, funded from the existing sink reserve only when the reserve also covers QIP-1's remaining sessions, while preserving the $50 per-seat ceiling, the 0.25% supply-value bound and the existing claim, report and bell routes?

### Opening input and stops

On a max day, effective input is `max(measuredNet24hUsd, 50 * N)` with N > 0; with no seats there is no max-day adjustment. The successful Open event is authoritative for the cap and seat count.

Before each max day require `freeUsd >= 2000 + 50 * N * M + 10 * N * K`, with fresh, readable reserve and oracle data, reconciled provider funding and accounting and no published emergency stop. The $2,000 buffer counts once. Before the first successful max day a failed check skips that candidate. After it, any failed check latches the pilot off; resuming needs a new proposal. A failed input measurement postpones opening under the existing retry rule. A stop affects the next opening and cannot cancel the current session's cap or bell.

Publish each max day's policy record before sending open, with N, M, K, measured input, effective input, freeUsd and the gate value, and link it to the Open event. Keep versioned records bound to the frozen policy and actual Open, including every skipped candidate and stop reason, and append bell seat count, real use per seat, the number of seats whose real use exceeded $10, provider debt and forwarding receipts, successful burns and Died amounts, stating that on-chain tax24hUsd stores effective input rather than measured fees. Within 72 hours after the second candidate's bell, publish the review described in "What is reported".

### Interaction with QIP-1 and backing rounds

QIP-1 and QIP-2 are independent ballots. If both are active, a max day uses the QIP-2 input and that session still counts as one of QIP-1's 14 sessions; the two inputs never add. Each check uses the same fresh reserve snapshot. If the QIP-2 check fails on a max day, QIP-1 may still apply that session if it is active and its own check passes. On a max day the regular cap already equals the upper bound, so an active backing round backs nothing that day, as QIP-4 states.

### Choices and outcome

For runs the pilot as written. Against leaves policy unchanged. Abstain counts for quorum and for the five-address minimum only. Passing follows the [charter](charter-fast.md).