> ## Documentation Index
> Fetch the complete documentation index at: https://docs.decdn.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Governance

> Voting weight is bytes actually delivered, not TOKEN held — a 4% quorum, a 2-day timelock, hardcoded safety bounds, and a 3-of-5 emergency multisig.

## Decision

OpenZeppelin Governor whose voting weight is an operator's **delivered bytes over a trailing window** — not TOKEN balance — with a **4% quorum** and a **2-day timelock**. All governable parameters have hardcoded safety bounds that governance cannot override. A **3-of-5 emergency multisig** can pause contracts, add emergency blacklist entries, and triage disputed slashes and blacklist entries. Its sunset is **split by capability**: the protocol-wide `pause()` brake has a **12-month sunset** enforced via an immutable constructor deadline — governance cannot extend it; prolonging `pause()` past the deadline requires deploying a new contract version and migrating through the standard upgrade path. The narrow unlawful-content-removal power — emergency blacklisting — is **permanent**, discharging an ongoing legal-compliance duty the \~11-day governance takedown path cannot meet.

## Voting weight

Voting weight is each operator's **served bytes over a trailing window** (default \~1 quarter, governable), scaled by a tenure ramp and capped per operator (default 5% of the window's bytes).

* **Passive TOKEN holders have no vote.** Governance power tracks real delivery, not holdings — you must operate a node and serve bytes to vote.
* **Fresh operators ramp in.** A new operator that serves heavily on day one still votes at a fraction of its byte share until the tenure ramp completes over several months.
* **Slashing zeroes out the vote.** A slashed operator's weight drops to zero for the rest of the window, then recovers as the window slides past the slash.

Bytes are read from the on-chain `FeeRouter` settlement counter, so weight is auditable and cannot be claimed without paid delivery.

### Launch phase

Served-bytes DAO voting only activates once the operator set is large enough to make it safe. Until then — the first 6–12 months post-launch — a **5-of-9 bootstrap multisig** (distinct from the emergency multisig) operates the protocol within the same safety bounds. The bootstrap phase ends, irreversibly, when the active operator count reaches **≥ 30** *and* total declared capacity reaches **≥ 100 Gbps**; at the transition, governance role authority transfers to the timelock-controlled Governor and the bootstrap multisig cannot be reinstated.

## Hardcoded safety bounds

Even governance cannot set parameters outside these bounds:

| Parameter                                 | Bounds      |
| ----------------------------------------- | ----------- |
| Operator revenue share (`FeeRouter` base) | 40% – 90%   |
| Burn share (`FeeRouter`)                  | ≥ 5%        |
| Dispute window                            | 12 h – 72 h |
| Per-operator voting cap                   | 1% – 25%    |
| Unbonding window                          | 7 – 60 days |

Bounds are enforced in `require()` checks in the setter functions. A malicious governance proposal that attempts to push the operator revenue share below its floor simply reverts. (Slashing tiers — 5% / 15% / 50% by lifetime offense count — are fixed constants, not governable parameters; see [slashing](/protocol/slashing).)

## Emergency multisig

3-of-5 signers. Limited to:

* **Pause** any contract (`Pausable`)
* **Add emergency blacklist entries** (with 14-day auto-expiry or 90-day for CSAM/terrorist categories — see [takedown](/protocol/takedown))
* **Triage disputed slashes and blacklist entries** — fast-track or reject an appeal within a fixed window, never decide it unilaterally

Can **not**:

* Move funds
* Change parameters
* Grant roles

The sunset is **split by capability**. The protocol-wide `pause()` brake carries a **12-month sunset** enforced in the multisig's constructor as an immutable deadline — after it, `pause()` reverts on-chain. Emergency **blacklisting does not sunset**: `emergencyAdd()`, `emergencyAddOrigin()`, and `suspendRegionalBody()` are permanent, because unlawful-content removal (CSAM / court-ordered / sanctions) is a time-critical legal duty the \~11-day governance takedown path cannot meet, and touches no economic, treasury, or governance lever. Governance **cannot** modify the `pause()` deadline; retaining `pause()` past the sunset requires deploying a new contract version with a new deadline and migrating to it via the standard upgrade path (timelock + governance vote). This guarantees the `pause()` sunset cannot be silently extended.

## Proposal flow

1. Proposer's served-bytes weight ≥ the proposal threshold.
2. `propose()` with target, calldata, description.
3. Voting period (default 7 days, after a 1-day voting delay).
4. Quorum check — 4% of total delivered bytes in the trailing window.
5. Queue in timelock (2 days).
6. Execute.

The combined \~10-day minimum delay (voting delay + 7-day period + 48-hour timelock) is deliberately longer than the OpenZeppelin Governor defaults, reflecting operator-class participation cadence.

## Why 4% quorum

Low enough that realistic participation can reach quorum; high enough that no single operator can unilaterally pass a proposal — and the per-operator weight cap bounds concentration directly. 4% maps to established DAO practice (Compound, Uniswap) and works in conjunction with the hardcoded safety bounds — the bounds mean a bad quorum can still only move parameters within the safe range.

## Regional governance bodies

[Content takedown](/protocol/takedown) introduces regional governance bodies with region-scoped blacklist authority. This is the only role that's partitioned by jurisdiction; all other roles are single-tier global governance.