Execution is what turns a pass…ite: CHECKPOINT_CAP entries – 11,520, eight44,640, 31 days of traded minutes, in th… core deployed on Stokenet on 25 Septem6 October 2026, and 44,640, 31 days, in the source the mainnet core will be published from; the core of 25 September held 11,520, eight days – since a minute with no trad… a phase it could never leave.

Execution is what turns a pass…is what opens that window: it takes no payment, asserts the legislative pass, collects the execution fee the ballot's second question assigned, locks the caper's trailing t… a phase it could never leave.

Who pays to settle Whoever mak… was somebody else's fee. The creation fee kept the shape the allowance gave it. It isallowance was sized to the flat – 500 XRD banked when the proposal is raised, kept whether it passes or fails – and thcreation fee that ran from 29 August to 6 October 2026; over that stretch a separate 10% execution chargfee on the winning action is a separate, later leg that rides the trigger. It is not a floor under a percentage: an earlier deployment didrode the trigger. From 6 October 2026 the proposer pays one fee at creation instead – 1% of the largest option’s XRD value, at least 500 XRD – and the trigger is free. A deployment before 29 August sized the creation fee as the great… 500 XRD and 10% of the action, and m. Material describing it that waythat quotes a 10% proposal fee at either moment, including some of Caper's own, is describing thea retired shape.

Hand-rolling an executor manif…ich of up to five options wins and whether the treasury or the proposer pays to execute it; the market then vetoes, or d…tle-path gas subsidy outright. Until 6 October 2026 a ballot also decided whether the treasury or the proposer paid a 10% fee to execute the winner; the redeploy of that day moved the whole proposal fee to creation and made the trigger free, which took the question off the ballot. The escrow is the piece that …ot era and is kept as written.

Topic Carrying out a passed pr…of its resolution or it lapses; UPGRADE’s activate leg within 7 days of the end of the registry’s timelock Replay guards Four once-only… (/wiki/markets/raising-funds)

Execution is what turns a pass…finite: CHECKPOINT_CAP entries – 11,520, eight days of traded minutes, in the core deployed on Stokenet on 25 September 2026, and 44,640, 31 days, in the source the mainnet core will be published from – since a minute with no trade …lapses instead of lying armed. UPGRADE’s second leg reads the action back without that prologue, so it carries a deadline of its own: since the logic upgrade of 1 October 2026, execute_proposal_upgrade_activate refuses once one execution window, seven days, has passed since the registry’s timelock let the candidate in. The deadline arrived with the… a phase it could never leave.

The executive actions - PAYOUT…egistry's timelock has elapsed, and no later than seven days after that. On a zero-delay deployment b…nd a treasury is not a member.

Execution is what turns a pass…ge is at or above the baseline. The root $XRD caper has no curve, so since the redeploy of 15 September 2026 its trigger locks a baseline on a reference basket of other capers' curve prices and its resolve passes iff the basket's window average is at or below it; Voting mechanisms (/wiki/governance/voting-mechanisms) sets out why the test inverts (trigger_proposal and resolve… a phase it could never leave.

Execution is what turns a pass…e is at or above the baseline. The root $XRD caper has no curve, so since the redeploy of 15 September 2026 its trigger locks a baseline on a reference basket of other capers' curve prices and its resolve passes iff the basket's window average is at or below it; Voting mechanisms (/wiki/governance/voting-mechanisms) sets out why the test inverts (trigger_proposal and resolve_proposal in contracts/logic/src/lib.rs). Integrating rather than sampl… a phase it could never leave.

Topic Carrying out a passed pr…→ voting → crystallize_ballots (only past 60 ballots) → settle_proposal → trigger_p…ee (no treasury subsidy since 911 September 2026) Deadline A p… (/wiki/markets/raising-funds)

Execution is what turns a pass…g armed. The deadline arrived on 9with the redeploy of 11 September 2026 and answers a … a phase it could never leave.

Who pays to settle Whoever mak…osts a network fee, and since 911 September 2026 the caller car… describing the retired shape.

Topic Carrying out a passed pr… are permissionless Who pays The caper's own treasury: 5 XRD a call, against a 500 XRD per-proposal allowanceWhoever makes the call – each crank pays its own network fee (no treasury subsidy since 9 September 2026) Deadline A passed action must execute within 7 days of its resolution or it lapses Replay guards Four once-only… (/wiki/markets/raising-funds)

Execution is what turns a pass…however late the crank lands, which is why reimbursing the settle path from the treasuryso a prompt crank buys convenience rather thanand not correctness – which is much of why the platform stopped paying anybody to be prompt. The settlement written to st…kind before it does anything. Neither stepSettlement has ano deadline. A passed proposal stays executable until somebody executes it, and a failed one; execution does. resolve_proposal stamps an execute_by of seven days from the moment it records the verdict, and the shared execution prologue refuses every entry point past it, so a passed action nobody carries out lapses instead of lying armed. The deadline arrived on 9 September 2026 and answers a specific failure: an action larger than its treasury can cover aborts on the shortfall and stays armed, so before the clock a payout voted through in a window measured in minutes could sit dormant for years and then fire the moment the treasury happened to fill. A failed proposal is simply never executable. S… a phase it could never leave.

Once-only, in one substate wri…cribing precisely, because it is what makes the gas reimbursement below safcarries the whole once-only guarantee. In a single open of the pro…s it has not already executed, asserts the seven-day execution window has not closed, flips executed, and binds the frozen action. Only then does it draw gas. If anyIf any of those four assertions fails, or the action itself a…he transaction, the flag flip and the draw rolls back togetherwith it — there is no state in which a caper has paid for an execuspent its one execution on an action that did not happen.

Who pays to settle Whoever makes the call. Both steps are permissionless work that costs gas, and leaving that bill with whoever happens to click Settle taxes one member for something the whole caper consumes. So the caper's treasury (/wiki/foundations/what-is-a-caper) reimburses it: 5 XRD per call, drawn against a 500 XRD allowance per proposal. The caller still fronts a fee reserve to the network and ends a committeda network fee, and since 9 September 2026 the caller carries it: there is no treasury reimbursement anywhere on the settle path, and the deployed contract has no gas parameter on any crank entry point. There was one until then, and why it went is worth stating, because it is a general lesson about paying for public goods on a ledger rather than a detail of this one. The caper's treasury used to lock up to 5 XRD contingently against each settle-path call, against a 500 XRD allowance per proposal sized to match the flat creation fee, so a proposal funded its own settlement out of what it had banked. The flaw was not the size of the subsidy but its scope. The Radix Engine consumes locked fees in reverse lock order – locked_fees.iter().cloned().rev() (https://github.com/radixdlt/radixdlt-scrypto/blob/main/radix-engine/src/system/system_callback.rs) – so the treasury's lock was always drawn before the caller's, and the subsidy therefore paid the first 5 XRD of the caller's whole. That allowance is exactly the size of the proposal fee, and the equality is deliberate rather than coincidental. The creation fee is flat – 500 XRD banked when the proposal is raised, kept whether it passes or fails – and the 10% execution charge on the winning action is a separate, later leg that rides the trigger. It is not a floor under a percentage: an earlier deployment did size the creation fee as the greater of 500 XRD and 10% of the action, and material describing it that way, including some of Caper's own, is describing the retired shape. What the equality buys is the property that matters here: a proposal can never cost its treasury more to settle and execute than it banked on the way in, which is what stops settlement from being an attack surface: raising a proposal purely to drain a treasury through crank reimbursements costs the attacker more than it yields. The draw takes its XRD before the action spends any. An action sized to a treasury's last few XRD therefore aborts on the shortfall rather than paying short – the same abort a treasury that fell below the proposed amount already gives, and equally retryable once it is topped up transaction rather than the first 5 XRD of the crank. Any manifest carrying one successful settle-path call had its opening cost met by a treasury it did not own, whatever else that manifest did, and crystallize_ballots will accept a chunk of a single ballot. Bounded by the proposer's own fee, so it was fee recycling rather than a drain – but it was somebody else's fee. The creation fee kept the shape the allowance gave it. It is flat – 500 XRD banked when the proposal is raised, kept whether it passes or fails – and the 10% execution charge on the winning action is a separate, later leg that rides the trigger. It is not a floor under a percentage: an earlier deployment did size the creation fee as the greater of 500 XRD and 10% of the action, and material describing it that way, including some of Caper's own, is describing the retired shape.

Hand-rolling an executor manif…s retuned to a shorter window. The redeploy of 11 September 2026 left both phases alone and changed two things on this page instead – it put a seven-day clock on a passed action, and it removed the settle-path gas subsidy outright. The escrow is the piece that …ot era and is kept as written.

Topic Carrying out a passed pr…proposal → trigger_proposal → 48-hourmarket window → resolve_proposal → e… (/wiki/markets/raising-funds)

Execution is what turns a pass… do, and the market then gets forty-eight hoursa window to veto it before it happens.…t's second question assigned, freezelocks the caper's trailing seven-day time-weighted average price as…line, and stamps a window end forty-eight hours outone market window out, aligned up to the state tier's minute grid. Once that window closes, resolve_proposal integratereads the price over th-time window itself – anchoredtegral at theat recorded window end, – not at the moment of the crank – and passes iff thate window's average is at or above the ba…r one block; a window average costs price displacement multiplied by durationhas to be displaced and then held for a real share of the window, so an atomic buy → resolve →… same number a prompt one does – but only while the observations that average is built from are still retained, and that bound is worth stating rather than assuming. The window average is only as long as the price history behind it. A caper records one circulation observation per trade into a fixed ring of 200, held as a key-value ring rather than a list so the protocol's hottest path writes one small entry instead of rewriting an array (price_samples, contracts/core/src/caper_dao.rs). The averaging function clips the window's left edge to the oldest observation still retained and divides by that clipped span, silently – the loudest of the three answers to th. The integral is exact, not sampled. The state tier keeps a running price-time accumulator: at the tail of each of the three operations that change circulation – a buy, a sell, a migration – it adds the price in force multiplied by the seconds it held, and it writes one checkpoint of that total at the start of every minute that sees a trade (contracts/core/src/caper_dao.rs). Window ends and baseline starts sit on that minute grid, so the integral at each is read exactly – from state if nothing has traded since, otherwise bound is Uniswap v3's, which reverts instead ( price oracles in governance (/wiki/dao-governance/concepts/voting/price-oracles-in-governance) ): once the ring has turned over past the start of the forty-eight hours, what resolves the proposal is the average over whatever remains, not over the window. The same clipping applies to the seven-day baseline taken at the trigger. Two consequences follow and they point the same way. A heavily traded caper resolves against a shorter and more recent interval than a quiet one, and a crank left late enough resolves against a different number than a prompt one would have. That, rather than politeness, is the sharpest argument for reimbursing the settle path from the treasury: the reimbursement buys promptness, and promptness is what keeps the integral an integralack from the first checkpoint after it – and a burst of trades inside one minute writes one checkpoint rather than one per trade. The checkpoint ring is finite: CHECKPOINT_CAP entries, eight days of traded minutes, since a minute with no trade writes nothing, and the trailing baseline's length is pinned under it when the logic is compiled. Only a resolve cranked more than that many traded minutes after its window end moves the anchor, to the oldest retained checkpoint, and extends the window to it – deterministically, where Uniswap v3 reverts instead ( price oracles in governance (/wiki/dao-governance/concepts/voting/price-oracles-in-governance) ). Inside that bound the verdict is fixed at the window end however late the crank lands, which is why reimbursing the settle path from the treasury buys convenience rather than correctness. The settlement written to st… a phase it could never leave.

Hand-rolling an executor manif…vetoes, or does not, over the forty-eight hoursmarket window that follows. Neither phase can carry an a… and never reaches the second. The redeploy of 7 September 2026 kept both phases and changed the measurement underneath the second: an exact price-time integral read through minute checkpoints replaced a 200-entry ring of per-trade samples, and the trailing baseline was retuned to a shorter window. The escrow is the piece that …ot era and is kept as written.

Topic Carrying out a passed pr…DATA · UPGRADE ($CAPER only) Non-executive outcome A DEBATE winner is terminal at the tally – trigger_proposal refuses it, so no window and no execution Who may call Anyone — both ste… (/wiki/markets/raising-funds)

Execution is what turns a pass… to veto it before it happens. Not every passed proposal has that tail: a ballot won by a DEBATE option ends at the tally, and nothing on this page applies to it. Execution proper is the last …ne is simply never executable. Since 5 September 2026 there is a third end state: a proposal whose winning option was a DEBATE position has passed and is never executable, because it never named an action to execute. trigger_proposal asserts the winning option's kind is not 6 and aborts if it is, so such a proposal cannot park in a phase it could never leave.

Hand-rolling an executor manif… Borda tally, checked against athe same 1.5 / N supermajority the live system uses – three-quarters of the 2 / N ceiling a Borda leader can take at any ballot size (/wiki/governance/voting-mechanisms) , then subjected to a market v…low. Neither phase can carry a proposaln action alone: a ballot that passes i…a ballot named a winner first. That symmetry has had one exception since 5 September 2026: a DEBATE option carries no action, so a ballot it wins is carried by the first phase alone and never reaches the second. The escrow is the piece that …ot era and is kept as written.

Execution is what turns a pass…by that clipped span, silently – the loudest of the three answers to this bound is Uniswap v3's, which reverts instead ( price oracles in governance (/wiki/dao-governance/concepts/voting/price-oracles-in-governance) ): once the ring has turned ove…ne is simply never executable.

Execution is what turns a pass… same number a prompt one does.– but only while the observations that average is built from are still retained, and that bound is worth stating rather than assuming. The window average is only as long as the price history behind it. A caper records one circulation observation per trade into a fixed ring of 200, held as a key-value ring rather than a list so the protocol's hottest path writes one small entry instead of rewriting an array (price_samples, contracts/core/src/caper_dao.rs). The averaging function clips the window's left edge to the oldest observation still retained and divides by that clipped span, silently: once the ring has turned over past the start of the forty-eight hours, what resolves the proposal is the average over whatever remains, not over the window. The same clipping applies to the seven-day baseline taken at the trigger. Two consequences follow and they point the same way. A heavily traded caper resolves against a shorter and more recent interval than a quiet one, and a crank left late enough resolves against a different number than a prompt one would have. That, rather than politeness, is the sharpest argument for reimbursing the settle path from the treasury: the reimbursement buys promptness, and promptness is what keeps the integral an integral. The settlement written to stat…ne is simply never executable.

Who pays to settle Both steps …le. That allowance is exactly why the proposal fee has a 500 XRD floor. Athe size of the proposal fee, and the equality is deliberate rather than coincidental. The creation fee is flat – 500 XRD banked when the proposal is raised, kept whether it passes or fails – and the 10% execution charge on the winning action is a separate, later leg that rides the trigger. It is not a floor under a percentage: an earlier deployment did size the creation fee as the greater of 500 XRD and 10% of the action, and material describing it that way, including some of Caper's own, is describing the retired shape. What the equality buys is the property that matters here: a proposal can never cost its t…etryable once it is topped up.

Topic Carrying out a passed proposal Timeline Creation → voting → crystallize_ballots → settle_proposal → trigger_proposal → 48-hour window → resolve_prop…osal allowance Replay guards TwoFour once-only flags: tallied, triggered, settled, then executed Related Proposals … (/wiki/markets/raising-funds)

Execution is what turns a pass…posals) into a state change. On a caper it iIt is the tail of a two-phase lifecycle: a ranked ballot (/wiki/governance/voting) decides what the caper should do, and the market then gets forty-eight hours two separate permissionless calls,veto it before it happens. Execution proper is the last two permissionless calls of that sequence – resolve, then execute – made by anyone at all, andwith nothing about either dependsing on who makes it. Resolve settles the verdict. After the proposal's 48-hour window closes, resolve_proposal reads the caper's live curve price, compares it with the seven-day TWAP baseline frozen at creation, and records the outcome:market's verdict on a proposal the ballot already passed. trigger_proposal is what opens that window: it asserts the legislative pass, collects the execution fee the ballot's second question assigned, freezes the caper's trailing seven-day time-weighted average price as the baseline, and stamps a window end forty-eight hours out. Once that window closes, resolve_proposal integrates the price over the window itself – anchored at the recorded window end, not at the moment of the crank – and passeds iffspotthat window average is at or above the baseline, failed if below. The settlement it writes carries all three numbers – the baseline, the spot it was measured against,. Integrating rather than sampling is the load-bearing choice. A spot read at the crank could be bought for one block; a window average costs price displacement multiplied by duration, so an atomic buy → resolve → sell round-trip buys no verdict. Anchoring at the stored window end rather than at now also makes a late crank read the same number a prompt one does. The settlement written to state carries the baseline, the window average and the verdict –, so the decision can be audite…ne is simply never executable.

Once-only, in one substate write TwoFour flags guard the whole path, and each flips exactly once. settltallied flips when the verdict is recorded, so a second resolve is refused outright – the priceballot count is frozen, so a proposal cannot be counted twice or voted on afterwards. triggered flips when the optimistic window opens, which is also what fixes the baseline – a second trigger cannot be re-fread latereze it at a more convenient momentprice. settled flips when the market's verdict is recorded, so the window average cannot be re-integrated later. executed flips in the shared…execution that did not happen.

Hand-rolling an executor manif…g instead of a clean summary. What this replaced Until August 2026 this page documented a considerably larger apparatus, and it is worth recording that it existed. A proposal's ballots were released from a per-caper ballot boxThree eras, and what each one changed This path has been rebuilt twice in a month, and the older material still circulating describes one of the two retired shapes, so it is worth dating all three. - To 26 August 2026 — escrowed ballots. Members staked governance tokens into a per-caper ballot box. Ballots were released from it in batches, folded into a Bor…ecute were three guarded steps rather than two, and a thousand-ballot propos…ds of transactions to settle. Optimistic resolution collapsed all of it into one price comparison. The market veto is the piece that survived, in a sense – it is now the whole mechanism rather than a final gate on a tally- 26–28 August 2026 — price only. The ballots were removed outright. A proposal named one action, froze a baseline at creation, and passed forty-eight hours later on a single price comparison. There was no vote to cast and no quorum to reach. - From 29 August 2026 — both, in sequence. The ranked ballot returned in front of the optimistic phase rather than instead of it. A ballot decides which of up to five options wins and whether the treasury or the proposer pays to execute it; the market then vetoes, or does not, over the forty-eight hours that follow. Neither phase can carry a proposal alone: a ballot that passes is only a mandate to open the window, and a window that closes above its baseline executes nothing unless a ballot named a winner first. The escrow is the piece that did not come back. A ballot is now a plain wallet transaction – the contract reads the voter's balance rather than taking custody of it – and what makes moving tokens between casting and counting unprofitable is a clamp at settlement, not a lock-up. Further reading The Binding…ot era and is kept as written.

Hand-rolling an executor manif…r reading The Binding Vote (/wiki/blog/the-binding-vote) – why …ot era and is kept as written.

Topic Carrying out a passed proposal Timeline Voting closes → execution delay (~10 min, ballots still arriving) → release ballots (3 per transaction) → market-veto tail (6 h) → finalize → execute Executive action kinds PAYOUT · INVEST · DIVEST · VOTE · UPGRADE ($CAPER only) Replay guards Two once-only flags: settled, then executed Market veto Finalize cancels a passed tally if the curve's time-weighted price from voting close to finalize sits >30% below the voting-window mean Settlement gas Treasury-reimbursed, up to 5 XRD per call against a 500 XRD per-proposal allowance Live logic tier CaperMain on Stokenet (https://stokenet-dashboard.radixdlt.com/component/component_tdx_2_1cr0wpsnnfk3rkxzkn9e39n2su5sgd9nctfcxh4rmt9dtpre2ngalht) , resolved from the registry (https://stokenet-dashboard.radixdlt.com/component/component_tdx_2_1crd7wmgsa465q4ceqnlcwh9pc8pmsxhdthat86379axx74cse5ml4d) 's current_main; live since 25 August 2026, carrying the ballot-era release/finalize path and the market veto Related Proposals (/wiki/governance/proposals) , Voting (/wiki/governance/voting) , Voting mechanisms (/wiki/governance/voting-mechanisms) , Proposal lifecycle (/wiki/dao-governance/concepts/voting/proposal-lifecycle)

A proposal's voting window closes on a clock, and an execution delay of the same length runs after it: ten minutes each on the live contract (https://stokenet-dashboard.radixdlt.com/component/component_tdx_2_1cr0wpsnnfk3rkxzkn9e39n2su5sgd9nctfcxh4rmt9dtpre2ngalht) today. Neither is a lever anyone can pull: both are written once when a logic component is instantiated and never assigned again, so moving either takes a whole new logic tier and a move of the registry's current_main. Ballots keep arriving through that delay. A member signs their ballot as a pre-authorization subintent during the voting window, and the settlement assembler packs those signatures into batched transactions submitted afterwards, so the timelock and the ballot-collection phase are the same window. Nothing can execute inside it, which is the role a timelock plays in mainstream DAO governance (/wiki/dao-governance/concepts/voting/proposal-lifecycle) . Once the delay expires, resolution happens in public steps anyone can run. Release hands the ballots to the immortal record a few at a time: each one writes its audit blob, banks the voter's escrowed vote fee, mints their soulbound vote token, and unlocks the stake that backed it. Finalize then freezes the winner from accumulators the ballot box has been summing since the first ballot landed – but not the moment release finishes: the live contract holds it back a further six hours, the objection window in which the caper's own market can cancel a passed tally. Finally, anyone submits the transaction that executes the winning option.

Release, finalize, execute – once-only guards Resolution is guarded at every step: the release cursor only moves forward, each ballot is released exactly once, and a proposal can never be finalized twice or executed twice. Release. Anyone can hand the next batch of ballots from the caper's ballot box to the immortal core. Batch size ships at three ballots per transaction, and that number is measured rather than chosen: profiled in a local ledger simulator on 15 August 2026, the release path costs roughly 34.3M cost units of base plus 12.09M per voter, so three fit inside 80% of the engine's per-transaction ceiling at a fee of about 4.1 XRD, under the 5 XRD the treasury reimburses. A five-ballot crank measures about 5.6 XRD on the same harness and tips past that ceiling, leaving the settler to eat the overflow – which is why the chunk is three rather than five (RELEASE_CHUNK, contracts/logic/src/lib.rs; profile_release_scaling and profile_settlement_gas_is_reimbursed_by_treasury, contracts/logic/tests/profile.rs). Both are simulator measurements rather than observations of the deployed component. Release refuses to start while casting is still open and refuses to run after a proposal has settled, so the audit record is always written before the decision is frozen. A voter whose account refuses deposits gets a single-ballot fallback that lands the record and the fee but parks the token mint for them to claim later, rather than poisoning every ballot batched alongside it. Finalize. Finalizing reads the finished count and freezes the winner. It is O(1) in the electorate: there is no tally pass, because each ballot's Borda contribution was folded into the running accumulators the moment it was cast. The option with the greatest summed weight wins only if its share of the total weight reached the 1.5 / N supermajority – the comparison is >=, so a share landing exactly on the bar passes – and it is not the no-execution option, and the market veto described below did not fire; otherwise the proposal finalizes with no winner. Every cast ballot must have been released first, and the immortal core enforces the same ordering from the other side by refusing new ballots once a settlement is recorded. This step flips a settled flag and can run only once. Execute. With a winner frozen, execution flips a separate executed flag, the guard that stops the same winning action from being replayed. A settled proposal that did not pass has no winner to execute, and a legislative proposal (/wiki/governance/proposals) 's winner carries no on-chain action at all, so only executive winners reach this step.

The market veto Clearing the supermajority is not the last gate. Since 25 August 2026 the live logic tier carries an optimistic market veto: a proposal whose tally passed is cancelled at finalize if the caper's own bonding-curve (/wiki/markets/bonding-curve) price fell far enough while the decision was pending. The tally answers what the electorate that showed up wanted; the veto asks what everyone else did with their money afterwards. Two windows are compared, and both are time-weighted rather than sampled. The baseline runs from voting open to voting close; the objection window runs from voting close to the moment finalize is called. The immortal state tier integrates circulation exactly over each one – a caper's curve price is a step function that moves only at the sites that mint or burn tokens, so one accumulator advance per trade is the whole average, with no sampling and no ring buffer. Each window's mean circulation is then converted into a price, which is sound precisely because the curve's spot price is strictly monotone in circulation, so a threshold set in price space transfers. The veto fires when the objection-window price sits more than 30% below the baseline – veto_drop_threshold, read as 0.3 off the live logic component on 26 August 2026. It is deliberately one-sided, and that is the design rather than an accident of implementation. On a bonding curve, pushing the price down means selling float you actually hold, while holding it up takes only outside XRD that anyone can bring – so objection is expensive and honest, and support is rentable. Counting only the downward move means silence executes: a caper nobody traded during the window, and the $XRD (/wiki/foundations/what-is-a-caper) caper (which has no curve at all, and is excluded by name), both settle exactly as they did before the veto existed. What the veto adds is a way for holders who never voted to stop a decision, at the price of selling into it. The gate carries a clock of its own. finalize_proposal refuses to run until six hours after the execution delay closes – veto_tail_seconds, 21600 on the live contract – and that tail is what guarantees the market time to answer. Casting stays open right through the execution delay, so without it a last-second ballot could flip a tally with no window left to react. Release is not held back: ballots can be released as soon as casting closes, so on a large proposal the release cranks and the objection window run alongside each other. Both parameters are logic-tier policy, rewritten together by update_veto and bounded to [0, 1]; a threshold of 1 disables the veto outright, since a price can never fall below zero. A vetoed proposal is recorded as vetoed rather than quietly dropped. The settlement blob gained a second version carrying a vetoed flag beside the option weights, the ProposalTallied event appends it, and the interface labels that outcome Market Vetoed – distinct from a proposal that simply never reached 1.5 / N. (finalize_proposal, contracts/logic/src/lib.rs; curve_time_averages, contracts/core/src/caper_dao.rs.) What it answers is turnout suppression rather than plutocracy. A caper's bar is 1.5 / N of the weight actually cast, not of supply, and there is no quorum (/wiki/dao-governance/concepts/voting/quorum-and-threshold-design) to fail – so a hostile proposal that thins the electorate, by timing or by noise or by anything that keeps stake unescrowed, faces only a ratio of whoever turned up. The veto puts a second constituency behind the first. Not a larger electorate, but the one thing a low-turnout attacker cannot manufacture: the price the caper's own holders will still accept.

Custody replaced the clamp Until 16 August 2026 this page described a different apparatus, and the difference is worth recording because the old one was a real design that a live upgrade retired. A ballot used to be credited the smaller of what the voter held when they voted and what they held when the tally ran; anyone could permissionlessly re-clamp a counted ballot downward, and a tally that was not taken in a single pass had to sit out a one-hour challenge window before it could settle. Snapshots, caps, clamping and the challenge window are all gone. What replaced them is physical custody. A member stakes governance tokens into the caper's ballot box before voting; a ballot's weight term is that vaulted stake, and casting refcount-locks it. The vault refuses to return a stake while any ballot it backs is still unreleased, so the same tokens can never back two counted ballots and a voter cannot sell what they voted with. Double-vote prevention became a property of where the tokens are rather than a rule about what the tally re-reads, which is why the re-clamp and the challenge window had nothing left to do. The swap itself went through the mechanism this page describes at the bottom. Proposal P-CAPER-7CD71F on the $CAPER (/wiki/foundations/what-is-a-caper) caper carried an UPGRADE option naming the new logic component, and its execution transaction (https://stokenet-dashboard.radixdlt.com/transaction/txid_tdx_2_1gyn66jhux2qcx7qgrfyt4e7m0pkq8yhymauqn6sgh3ghuk7culasxshjz3) called execute_proposal_upgrade and execute_proposal_upgrade_activate back to back on 16 August 2026 at 09:27:54 UTC. That transaction, and the component it activated, belong to a deployment Stokenet has since replaced twice over – and the way that citation ages is worth recording too. The registry it ran against, component_tdx_2_1czd3cm2… (https://stokenet-dashboard.radixdlt.com/component/component_tdx_2_1czd3cm28fkq6f08c9y52w0tw56p4k6dz5h3uf76jrmpgm8a8ashuey) , still answers, still holds real state, and still names that retired component as its own current_main: the whole citation self-confirms, so nothing about following it looks wrong. The live root is the registry in the infobox above, and resolving current_main there is the only thing that tells the two apart. Both calls fitted in one manifest because the registry carries a zero upgrade delay, then and now; on a network with a non-zero delay the propose and the activate are separated by it.

Who pays to settle Every step after the cast window closes is permissionless, and permissionless work still costs gas. A large proposal's release path is not one transaction but hundreds. At three ballots a transaction, a thousand-ballot proposal is roughly 334 release calls plus one finalize, and none of it is contingent on the proposal passing. Leaving that bill with whoever happens to click Settle taxes one member for a public good the whole caper consumes. That is the default almost everywhere else. In OpenZeppelin's Governor (https://raw.githubusercontent.com/OpenZeppelin/openzeppelin-contracts/master/contracts/governance/Governor.sol) and in Compound's Governor Bravo (https://raw.githubusercontent.com/compound-finance/compound-protocol/master/contracts/Governance/GovernorBravoDelegate.sol) , execute is an ordinary payable function with no access control: anyone may call it once the proposal is queued, and the caller pays the gas from their own pocket with nothing coming back. In practice the proposer, a delegate or a bot absorbs it, and the cost appears in none of the governance ledgers surveyed in DAO governance operating costs (/wiki/dao-governance/concepts/analysis/dao-governance-operating-costs) . What that unpriced work costs when a DAO buys it from an automation vendor instead, and why it stays invisible when it does not, is on who pays to execute a passed proposal (/wiki/dao-governance/concepts/analysis/proposal-execution-costs) . A caper reimburses it instead. Each call draws up to 5 XRD from the treasury against a per-proposal allowance of 500 XRD. The two figures match today, but not because the allowance was sized to the fee – the allowance is a contract constant, and it is the fee that is pinned to it. update_fees asserts proposal_fee >= SETTLEMENT_GAS_BUDGET, refusing any schedule that fails "proposal_fee must cover the settlement-gas budget", so the configured fee can be raised above the allowance but never cut below it. That floor, rather than a coincidence of defaults, is what guarantees a proposal funds its own settlement and can never cost the treasury more than it contributed. The allowance is one pool shared by the whole path: the batched cast transactions draw on it too, at up to 8 XRD each. At 5 XRD a release call it covers about a hundred of them, so a proposal past roughly three hundred ballots exhausts it and the remaining callers pay their own way. That degrades rather than bricks, and the vote fees banked at release, 100 XRD a ballot on the live contract, return far more to the treasury than the allowance can ever spend. The draw is a contingent fee lock, and that is load-bearing rather than a detail. A plain lock_fee credits the fee reserve immediately and survives an aborted transaction; a contingent lock never touches that balance (https://raw.githubusercontent.com/radixdlt/radixdlt-scrypto/main/radix-engine/src/system/system_modules/costing/fee_reserve.rs) and is charged only when the transaction commits. Without it, anyone could call a settle-path method, abort the transaction, and drain the treasury while the allowance counter rolled back every time. Because payment and allowance now move together, the worst a spammer gets is an allowance draining at the same rate real work would drain it. The draw rides each call's proposal read, so a release that finds nothing left to release still pays the keeper who ran it: honest work that happens to find nothing is still work. The allowance ledger itself lives in the immortal state tier beside the funds, while the budget and the per-call ceiling are logic-tier policy, so an UPGRADE (/wiki/governance/proposals) can retune what settlement costs without touching the record of what has already been spent.

The executive actions PAYOUT and INVEST each execute in a single call. PAYOUT transfers the chosen currency and amount out of the treasury to the stored, voted-on recipient — by way of an account locker (https://docs.radixdlt.com/docs/locker) rather than a direct deposit, so a recipient whose account rejects the resource cannot abort the execution; the payment simply waits to be claimed. That, and the rest of the treasury's plumbing, is covered under raising funds (/wiki/markets/raising-funds) . INVEST runs its whole withdraw → buy (/wiki/markets/bonding-curve) → deposit inside the contract's own call frame, so the treasury XRD it spends never touches the transaction worktop — a public executor cannot take part of the withdrawal and pocket the rest. The execution step asserts the bucket handed back is the target caper's token, in a positive amount, before it lands in the treasury. VOTE runs in two transactions and several manifest instructions, because it must re-enter a separate component mid-transaction. A preliminary call escrows the treasury's stake in the target caper's ballot box, in its own transaction so the execution itself stays under the engine's cost-unit ceiling, and the execution refuses to burn its once-only guard if that stake is not there: an unstaked treasury ballot would close gracefully to a silent zero. The execution proper then hands the manifest the target token, the XRD vote fee, and the treasury admin badge; the manifest presents that badge as a proof to authorise the treasury's vote into the target caper's proposal, routed through a fresh top-level frame; a final call returns the badge to its vault. Because the whole sequence is one atomic transaction, the admin badge never survives a transaction boundary outside the vault — if any step fails, the entire execution rolls back. DIVEST is INVEST run backwards, and it is the newest of the five. Execution withdraws the voted-on amount of the target caper's token from this treasury, sells it into that caper's curve (/wiki/markets/bonding-curve) , and deposits the XRD — again entirely inside the contract's own call frame, so the tokens never touch the worktop. Two guards ride it. The withdrawal aborts outright if the treasury's holding has fallen below the amount that passed, because executing a smaller trade than the one that was voted on would break the frozen-winner contract; and the sell asserts the bucket handed over is the target caper's own resource, so a stale address aborts rather than selling the wrong thing. The $XRD caper is excluded by name — it has no curve to sell into. Where INVEST fuses its guard and its withdrawal into one state-tier call, DIVEST composes two generic ones the immortal tier already exposes, paying an extra cross-package hop to avoid redeploying that tier; the whole action therefore shipped through the ordinary UPGRADE path with no per-caper migration. Its sell leg emits the same event an ordinary sale does, so it appears on the target caper's trade feed (/wiki/markets/trading) with no divest-specific arithmetic anywhere off-chain. UPGRADE is the one action reserved for the $CAPER (/wiki/foundations/what-is-a-caper) caper itself. Its winning option swaps the platform's live logic tier through the registry, in a two-phase propose-then-activate sequence — this is the mechanism by which the whole system upgrades itself under governance rather than under an admin key.

Where each action runs — state tier vs logic tier A caper (/wiki/foundations/what-is-a-caper) 's contract is split into an immortal state tier that holds the treasury and the durable proposal record, and a swappable logic tier that carries the math and the executive plumbing. Which tier performs a winner depends on what the action touches. PAYOUT executes inside the state tier, because the voted-on recipient is a Global<Account> that only stays invokable as a stable substate reference — it cannot be handed to the logic tier and called there. The state tier therefore performs the transfer to the stored recipient itself, and no executor can redirect it. INVEST, DIVEST, VOTE and UPGRADE carry no account reference, so the logic tier drives them, reading back only the frozen typed option from state. That division is why an upgrade can replace the entire logic tier without ever putting the treasury or the proposal ledger at risk.

Hand-rolling an executor manifest If you ever build an executor manifest by hand, end it with a try_deposit_*_or_abort: the Radix Engine's General transaction classifier only whitelists the _or_abort deposit variants, and the _or_refund forms make the wallet display a "Complex transaction" warning instead of a clean summary.

Further reading The Binding Vote (/blog/the-binding-vote) – why splitting the count from the deed, and leaving no executor to trust, is the thing an advisory vote and a multisig both fail to do.

Topic Carrying out a passed proposal Timeline Creation → 48-hour window → resolve_proposal → execute_proposal_* Executive action kinds PAYOUT · INVEST · DIVEST · METADATA · UPGRADE ($CAPER only) Who may call Anyone — both steps are permissionless Who pays The caper's own treasury: 5 XRD a call, against a 500 XRD per-proposal allowance Replay guards Two once-only flags: settled, then executed Related Proposals (/wiki/governance/proposals) , Voting (/wiki/governance/voting) , Raising funds (/wiki/markets/raising-funds)

Execution is what turns a passed proposal (/wiki/governance/proposals) into a state change. On a caper it is two separate permissionless calls, made by anyone at all, and nothing about either depends on who makes it. Resolve settles the verdict. After the proposal's 48-hour window closes, resolve_proposal reads the caper's live curve price, compares it with the seven-day TWAP baseline frozen at creation, and records the outcome: passed if spot is at or above the baseline, failed if below. The settlement it writes carries all three numbers – the baseline, the spot it was measured against, and the verdict – so the decision can be audited afterwards without re-deriving anything. Execute performs the action, and only if the settlement says passed. There is one entry point per action kind rather than a general one; the contract will not let you call the wrong one, because each asserts the stored action's kind before it does anything. Neither step has a deadline. A passed proposal stays executable until somebody executes it, and a failed one is simply never executable.

Once-only, in one substate write Two flags guard the whole path, and each flips exactly once. settled flips when the verdict is recorded, so a second resolve is refused outright – the price cannot be re-read later at a more convenient moment. executed flips in the shared prologue every execution entry point runs, so a passed proposal performs its action once and never again. The prologue is worth describing precisely, because it is what makes the gas reimbursement below safe. In a single open of the proposal's substate it asserts the proposal is settled, asserts it passed, asserts it has not already executed, flips executed, and binds the frozen action. Only then does it draw gas. If any assertion fails, or the action itself aborts later in the transaction, the flag flip and the draw roll back together — there is no state in which a caper has paid for an execution that did not happen.

Who pays to settle Both steps are permissionless work that costs gas, and leaving that bill with whoever happens to click Settle taxes one member for something the whole caper consumes. So the caper's treasury (/wiki/foundations/what-is-a-caper) reimburses it: 5 XRD per call, drawn against a 500 XRD allowance per proposal. The caller still fronts a fee reserve to the network and ends a committed call whole. That allowance is exactly why the proposal fee has a 500 XRD floor. A proposal can never cost its treasury more to settle and execute than it banked on the way in, which is what stops settlement from being an attack surface: raising a proposal purely to drain a treasury through crank reimbursements costs the attacker more than it yields. The draw takes its XRD before the action spends any. An action sized to a treasury's last few XRD therefore aborts on the shortfall rather than paying short – the same abort a treasury that fell below the proposed amount already gives, and equally retryable once it is topped up.

The executive actions - PAYOUT transfers the stored currency and amount out of the treasury to the stored recipient, by way of an account locker (/wiki/markets/raising-funds) rather than a direct deposit – a recipient whose account rejects the resource cannot abort the execution; the payment waits to be claimed. The transfer floors the amount to the currency's divisibility and reports what it actually moved, so the event can never overstate the payment. - INVEST runs its whole withdraw → buy → deposit inside the contract's own call frame. The treasury's XRD never reaches the transaction worktop, which closes the partial-withdraw skim a worktop hop would open, and the tokens bought are asserted to be the target caper's own before they are banked. - DIVEST is the same trade reversed: withdraw the stored amount of the target's token, sell it into that caper's curve (/wiki/markets/bonding-curve) , bank the XRD. It aborts if the treasury's holding has fallen below the proposed amount since settlement – executing a smaller trade than the one that passed would break the frozen-action contract. The sell is emitted onto the target caper's ordinary trade feed, so an indexer needs no divest-specific arithmetic. - METADATA rewrites the mutable metadata of the caper's own token. The target was pinned to that exact resource at creation, so the shared metadata badge cannot be aimed at a sibling resource such as the vote token or the founder badge. - UPGRADE is the only two-leg action. The first call nominates the candidate logic component to the registry; the second activates it once the registry's timelock has elapsed. On a zero-delay deployment both legs can ride one transaction. Reserved to $CAPER, because one activation changes the logic every caper on the platform runs. Neither INVEST nor DIVEST mints vote tokens (/wiki/governance/voting) . They are the treasury's trades, not a member's, and a treasury is not a member.

Where each action runs — state tier vs logic tier A caper's contract is split into an immortal state tier that holds the treasury and the durable proposal record, and a swappable logic tier that carries the math and the executive plumbing. Which tier performs a winner depends on what the action touches. PAYOUT executes inside the state tier, because the stored recipient is a global account reference that only stays invokable as a stable substate reference – it cannot be handed out to the logic tier and called there. Every other kind binds its frozen action in the state tier and is then driven by the logic tier, which is where the curve math and the registry calls live. The split is why a logic upgrade (/wiki/governance/proposals) can change how an action executes without migrating a single caper's treasury or proposal history.

Hand-rolling an executor manifest If you build an executor manifest by hand, end it with a try_deposit_*_or_abort: the Radix Engine's General transaction classifier only whitelists the _or_abort deposit variants, and the _or_refund forms make the wallet display a “Complex transaction” warning instead of a clean summary. What this replaced Until August 2026 this page documented a considerably larger apparatus, and it is worth recording that it existed. A proposal's ballots were released from a per-caper ballot box in batches, folded into a Borda tally, checked against a 1.5 / N supermajority, then subjected to a market veto that cancelled a passed tally if the curve price had fallen far enough while the decision was pending. Release, finalize and execute were three guarded steps rather than two, and a thousand-ballot proposal took hundreds of transactions to settle. Optimistic resolution collapsed all of it into one price comparison. The market veto is the piece that survived, in a sense – it is now the whole mechanism rather than a final gate on a tally. Further reading The Binding Vote (/wiki/blog/the-binding-vote) – why splitting the count from the deed, and leaving no executor to trust, is the thing an advisory vote and a multisig both fail to do. It argues from the ballot era and is kept as written.

A proposal's voting window clo…m/component/component_tdx_2_1cpn5xl5esqkj2f72zs3svxav3awqp4yu768zzwd8ye7au06lt7xlcr) today, both settable in the swappable logic tierr0wpsnnfk3rkxzkn9e39n2su5sgd9nctfcxh4rmt9dtpre2ngalht) today. Neither is a lever anyone can pull: both are written once when a logic component is instantiated and never assigned again, so moving either takes a whole new logic tier and a move of the registry's current_main. Ballots keep arriving throug…t executes the winning option.

Topic Carrying out a passed pr… ballots (3 per transaction) → market-veto tail (6 h) → finalize → execute Executive…lags: settled, then executed Market veto Finalize cancels a passed tally if the curve's time-weighted price from voting close to finalize sits >30% below the voting-window mean Settlement gas Treasury-reimbu…m/component/component_tdx_2_1cpn5xl5esqkj2f72zs3svxav3awqp4yu768zzwd8ye7au06lt7xlcr) ,r0wpsnnfk3rkxzkn9e39n2su5sgd9nctfcxh4rmt9dtpre2ngalht) , resolved from the registry (https://stokenet-dashboard.radixdlt.com/component/component_tdx_2_1crd7wmgsa465q4ceqnlcwh9pc8pmsxhdthat86379axx74cse5ml4d) 's current_main; live since 25 August 2026, carrying the ballot-era release/finalize path, activated 16 August 2026nd the market veto Related Proposals (/wiki/go…pts/voting/proposal-lifecycle)

A proposal's voting window clo… since the first ballot landed – but not the moment release finishes: the live contract holds it back a further six hours, the objection window in which the caper's own market can cancel a passed tally. Finally, anyone submits the …t executes the winning option.

Release, finalize, execute – o…its share of the total weight clearreached the 1.5 / N supermajority and it is not the no-execution option– the comparison is >=, so a share landing exactly on the bar passes – and it is not the no-execution option, and the market veto described below did not fire; otherwise the proposal final…utive winners reach this step.

Custody replaced the clamp Unt…ugust 2026 at 09:27:54 UTC. The registry (https://stokenet-dashboard.radixdlt.com/component/component_tdx_2_1czd3cm28fkq6f08c9y52w0tw56p4k6dz5h3uf76jrmpgm8a8ashuey) has pointed current_main at the new component ever sinceat transaction, and the component it activated, belong to a deployment Stokenet has since replaced twice over – and the way that citation ages is worth recording too. The registry it ran against, component_tdx_2_1czd3cm2… (https://stokenet-dashboard.radixdlt.com/component/component_tdx_2_1czd3cm28fkq6f08c9y52w0tw56p4k6dz5h3uf76jrmpgm8a8ashuey) , still answers, still holds real state, and still names that retired component as its own current_main: the whole citation self-confirms, so nothing about following it looks wrong. The live root is the registry in the infobox above, and resolving current_main there is the only thing that tells the two apart. Both calls fitted in one manifest because Stokenet'sthe registry carries a zero upgrade delay, then and now; on a network with a non-zero… activate are separated by it.

The market veto Clearing the supermajority is not the last gate. Since 25 August 2026 the live logic tier carries an optimistic market veto: a proposal whose tally passed is cancelled at finalize if the caper's own bonding-curve (/wiki/markets/bonding-curve) price fell far enough while the decision was pending. The tally answers what the electorate that showed up wanted; the veto asks what everyone else did with their money afterwards. Two windows are compared, and both are time-weighted rather than sampled. The baseline runs from voting open to voting close; the objection window runs from voting close to the moment finalize is called. The immortal state tier integrates circulation exactly over each one – a caper's curve price is a step function that moves only at the sites that mint or burn tokens, so one accumulator advance per trade is the whole average, with no sampling and no ring buffer. Each window's mean circulation is then converted into a price, which is sound precisely because the curve's spot price is strictly monotone in circulation, so a threshold set in price space transfers. The veto fires when the objection-window price sits more than 30% below the baseline – veto_drop_threshold, read as 0.3 off the live logic component on 26 August 2026. It is deliberately one-sided, and that is the design rather than an accident of implementation. On a bonding curve, pushing the price down means selling float you actually hold, while holding it up takes only outside XRD that anyone can bring – so objection is expensive and honest, and support is rentable. Counting only the downward move means silence executes: a caper nobody traded during the window, and the $XRD (/wiki/foundations/what-is-a-caper) caper (which has no curve at all, and is excluded by name), both settle exactly as they did before the veto existed. What the veto adds is a way for holders who never voted to stop a decision, at the price of selling into it. The gate carries a clock of its own. finalize_proposal refuses to run until six hours after the execution delay closes – veto_tail_seconds, 21600 on the live contract – and that tail is what guarantees the market time to answer. Casting stays open right through the execution delay, so without it a last-second ballot could flip a tally with no window left to react. Release is not held back: ballots can be released as soon as casting closes, so on a large proposal the release cranks and the objection window run alongside each other. Both parameters are logic-tier policy, rewritten together by update_veto and bounded to [0, 1]; a threshold of 1 disables the veto outright, since a price can never fall below zero. A vetoed proposal is recorded as vetoed rather than quietly dropped. The settlement blob gained a second version carrying a vetoed flag beside the option weights, the ProposalTallied event appends it, and the interface labels that outcome Market Vetoed – distinct from a proposal that simply never reached 1.5 / N. (finalize_proposal, contracts/logic/src/lib.rs; curve_time_averages, contracts/core/src/caper_dao.rs.) What it answers is turnout suppression rather than plutocracy. A caper's bar is 1.5 / N of the weight actually cast, not of supply, and there is no quorum (/wiki/dao-governance/concepts/voting/quorum-and-threshold-design) to fail – so a hostile proposal that thins the electorate, by timing or by noise or by anything that keeps stake unescrowed, faces only a ratio of whoever turned up. The veto puts a second constituency behind the first. Not a larger electorate, but the one thing a low-turnout attacker cannot manufacture: the price the caper's own holders will still accept.

Further reading The Binding Vote (/blog/the-binding-vote) – why splitting the count from the deed, and leaving no executor to trust, is the thing an advisory vote and a multisig both fail to do.

Release, finalize, execute – o…s measured rather than chosen: profiled in a local ledger simulator on 15 August 2026, the release path costs roughl… 5 XRD the treasury reimburses (RELEASE_CHUNK, contracts/logic/src/lib.rs). A five-ballot crank measures about 5.6 XRD on the same harness and tips past that ceiling, leaving the settler to eat the overflow – which is why the chunk is three rather than five (RELEASE_CHUNK, contracts/logic/src/lib.rs; profile_release_scaling and profile_settlement_gas_is_reimbursed_by_treasury, contracts/logic/tests/profile.rs). Both are simulator measurements rather than observations of the deployed component. Release refuses to start whi…utive winners reach this step.

Who pays to settle Every step…-proposal allowance of 500 XRD, deliberately the same figure as the default proposal fee that proposal already paid into that same treasury, so. The two figures match today, but not because the allowance was sized to the fee – the allowance is a contract constant, and it is the fee that is pinned to it. update_fees asserts proposal_fee >= SETTLEMENT_GAS_BUDGET, refusing any schedule that fails "proposal_fee must cover the settlement-gas budget", so the configured fee can be raised above the allowance but never cut below it. That floor, rather than a coincidence of defaults, is what guarantees a proposal funds its own sett…f what has already been spent.

The executive actions PAYOUT a…t lands in the treasury. VOTE is split acrossruns in two transactions and several manifest instructions… component mid-transaction. A first callpreliminary call escrows the treasury's stake in the target caper's ballot box, in its own transaction so the execution itself stays under the engine's cost-unit ceiling, and the execution refuses to burn its once-only guard if that stake is not there: an unstaked treasury ballot would close gracefully to a silent zero. The execution proper then hands the manifest the target…ather than under an admin key.

Topic Carrying out a passed proposal Timeline Voting closes → crystallize (chunked tally) → execution delay (~10 min) → settle → execute Executive action kinds PAYOUT · INVEST · DIVEST · VOTE · UPGRADE ($CAPER only) Replay guards Two once-only flags — settled, then executed Settlement gas Treasury-reimbursed — up to 5 XRD per call against a 500 XRD per-proposal allowance Related Proposals (/wiki/governance/proposals) , Voting (/wiki/governance/voting) , Voting mechanisms (/wiki/governance/voting-mechanisms) , Proposal lifecycle (/wiki/dao-governance/concepts/voting/proposal-lifecycle)

Once a proposal's voting window closes, resolution happens in public steps anyone can run: crystallize the ballots — fold them into an on-chain running count, in as many chunked transactions as the turnout needs, with no cap on how many members may vote — then, once the execution delay has elapsed (roughly ten minutes by default), settle the proposal to freeze the winner from that count, and finally submit the transaction that executes the winning option. The delay is a deliberate pause between the decision and the act — the same role a timelock plays in mainstream DAO governance (/wiki/dao-governance/concepts/voting/proposal-lifecycle) , giving members a window to react before an executive action lands.

Crystallize, settle, execute — once-only guards Resolution is guarded at every step: the tally cursor only moves forward, each ballot is counted exactly once, and a proposal can never be settled twice or executed twice. Crystallize. Anyone can fold the next chunk of ballots into a persistent on-chain count. Each ballot carries a vote weight (/wiki/governance/voting) , and that weight is spread across the options the ballot ranked: an option placed at rank i receives (N − 1 − i) times the voter's weight, so a first choice counts most and a last choice counts nothing. The weight's holdings term is clamped to the smaller of what the voter held when they voted and what they hold now, and until settlement anyone can re-observe a counted ballot and ratchet its credit further down if that stake has since moved — selling after voting only ever shrinks a vote. Because the count persists across transactions, turnout has no ceiling. Settle. Settling reads the finished count and freezes the winner. The option with the greatest summed weight wins only if its share of the total weight cleared the 1.5 / N supermajority and it is not the no-execution option; otherwise the proposal finalizes with no winner. A count completed in a single pass after the execution delay elapsed settles immediately; any other count must first wait out a one-hour challenge window in which anyone can re-check its ballots. This step flips a settled flag and can run only once. Execute. With a winner frozen, execution flips a separate executed flag — the guard that stops the same winning action from being replayed. A settled proposal that did not pass has no winner to execute, and a legislative proposal (/wiki/governance/proposals) 's winner carries no on-chain action at all — so only executive winners reach this step.

Who pays to settle Every step after voting closes is permissionless, and permissionless work still costs gas. A large proposal's settle path is not one transaction but dozens — a thousand-ballot proposal runs roughly fourteen crystallize chunks, roughly fourteen reclamp sweeps and a settle, at the contract's 75-ballot chunk size — and none of it is contingent on the proposal passing. Leaving that bill with whoever happens to click Settle taxes one member for a public good the whole caper consumes. That is the default almost everywhere else. In OpenZeppelin's Governor (https://raw.githubusercontent.com/OpenZeppelin/openzeppelin-contracts/master/contracts/governance/Governor.sol) and in Compound's Governor Bravo (https://raw.githubusercontent.com/compound-finance/compound-protocol/master/contracts/Governance/GovernorBravoDelegate.sol) , execute is an ordinary payable function with no access control: anyone may call it once the proposal is queued, and the caller pays the gas from their own pocket with nothing coming back. In practice the proposer, a delegate or a bot absorbs it, and the cost appears in none of the governance ledgers surveyed in DAO governance operating costs (/wiki/dao-governance/concepts/analysis/dao-governance-operating-costs) . What that unpriced work costs when a DAO buys it from an automation vendor instead, and why it stays invisible when it does not, is on who pays to execute a passed proposal (/wiki/dao-governance/concepts/analysis/proposal-execution-costs) . A caper reimburses it instead. Each settle-path call draws up to 5 XRD from the treasury against a per-proposal allowance of 500 XRD — deliberately the same figure as the default proposal fee that proposal already paid into that same treasury, so a proposal funds its own settlement and can never cost the treasury more than it contributed. The allowance covers the measured thousand-voter path around four times over; past it the draw returns zero and the caller pays, so an unusually large proposal degrades rather than bricks. The per-call figure is a ceiling, not a charge: the engine refunds whatever a lock does not consume. The draw is a contingent fee lock, and that is load-bearing rather than a detail. A plain lock_fee credits the fee reserve immediately and survives an aborted transaction; a contingent lock never touches that balance (https://raw.githubusercontent.com/radixdlt/radixdlt-scrypto/main/radix-engine/src/system/system_modules/costing/fee_reserve.rs) and is charged only when the transaction commits. Without it, anyone could call a settle-path method, abort the transaction, and drain the treasury while the allowance counter rolled back every time. Because payment and allowance now move together, the worst a spammer gets is an allowance draining at the same rate real work would drain it. Where the draw rides differs by entry point, and the difference is deliberate. Settle and reclamp gas their read, so a sweep that finds nothing to ratchet down still pays the keeper who ran it — honest work that happens to find nothing is still work. Crystallize gasses its write, so calling it again once the tally is already complete writes nothing and draws nothing. The allowance ledger itself lives in the immortal state tier beside the funds, while the budget and the per-call ceiling are logic-tier policy: an UPGRADE (/wiki/governance/proposals) can retune what settlement costs without touching the record of what has already been spent.

Topic Carrying out a passed proposal Timeline Voting closes → execution delay (~10 min, ballots still arriving) → release ballots (3 per transaction) → finalize → execute Executive action kinds PAYOUT · INVEST · DIVEST · VOTE · UPGRADE ($CAPER only) Replay guards Two once-only flags: settled, then executed Settlement gas Treasury-reimbursed, up to 5 XRD per call against a 500 XRD per-proposal allowance Live logic tier CaperMain on Stokenet (https://stokenet-dashboard.radixdlt.com/component/component_tdx_2_1cpn5xl5esqkj2f72zs3svxav3awqp4yu768zzwd8ye7au06lt7xlcr) , the ballot-era release/finalize path, activated 16 August 2026 Related Proposals (/wiki/governance/proposals) , Voting (/wiki/governance/voting) , Voting mechanisms (/wiki/governance/voting-mechanisms) , Proposal lifecycle (/wiki/dao-governance/concepts/voting/proposal-lifecycle)

A proposal's voting window closes on a clock, and an execution delay of the same length runs after it: ten minutes each on the live contract (https://stokenet-dashboard.radixdlt.com/component/component_tdx_2_1cpn5xl5esqkj2f72zs3svxav3awqp4yu768zzwd8ye7au06lt7xlcr) today, both settable in the swappable logic tier. Ballots keep arriving through that delay. A member signs their ballot as a pre-authorization subintent during the voting window, and the settlement assembler packs those signatures into batched transactions submitted afterwards, so the timelock and the ballot-collection phase are the same window. Nothing can execute inside it, which is the role a timelock plays in mainstream DAO governance (/wiki/dao-governance/concepts/voting/proposal-lifecycle) . Once the delay expires, resolution happens in public steps anyone can run. Release hands the ballots to the immortal record a few at a time: each one writes its audit blob, banks the voter's escrowed vote fee, mints their soulbound vote token, and unlocks the stake that backed it. Finalize then freezes the winner from accumulators the ballot box has been summing since the first ballot landed. Finally, anyone submits the transaction that executes the winning option.

Release, finalize, execute – once-only guards Resolution is guarded at every step: the release cursor only moves forward, each ballot is released exactly once, and a proposal can never be finalized twice or executed twice. Release. Anyone can hand the next batch of ballots from the caper's ballot box to the immortal core. Batch size ships at three ballots per transaction, and that number is measured rather than chosen: the release path costs roughly 34.3M cost units of base plus 12.09M per voter, so three fit inside 80% of the engine's per-transaction ceiling at a fee of about 4.1 XRD, under the 5 XRD the treasury reimburses (RELEASE_CHUNK, contracts/logic/src/lib.rs). Release refuses to start while casting is still open and refuses to run after a proposal has settled, so the audit record is always written before the decision is frozen. A voter whose account refuses deposits gets a single-ballot fallback that lands the record and the fee but parks the token mint for them to claim later, rather than poisoning every ballot batched alongside it. Finalize. Finalizing reads the finished count and freezes the winner. It is O(1) in the electorate: there is no tally pass, because each ballot's Borda contribution was folded into the running accumulators the moment it was cast. The option with the greatest summed weight wins only if its share of the total weight cleared the 1.5 / N supermajority and it is not the no-execution option; otherwise the proposal finalizes with no winner. Every cast ballot must have been released first, and the immortal core enforces the same ordering from the other side by refusing new ballots once a settlement is recorded. This step flips a settled flag and can run only once. Execute. With a winner frozen, execution flips a separate executed flag, the guard that stops the same winning action from being replayed. A settled proposal that did not pass has no winner to execute, and a legislative proposal (/wiki/governance/proposals) 's winner carries no on-chain action at all, so only executive winners reach this step.

Custody replaced the clamp Until 16 August 2026 this page described a different apparatus, and the difference is worth recording because the old one was a real design that a live upgrade retired. A ballot used to be credited the smaller of what the voter held when they voted and what they held when the tally ran; anyone could permissionlessly re-clamp a counted ballot downward, and a tally that was not taken in a single pass had to sit out a one-hour challenge window before it could settle. Snapshots, caps, clamping and the challenge window are all gone. What replaced them is physical custody. A member stakes governance tokens into the caper's ballot box before voting; a ballot's weight term is that vaulted stake, and casting refcount-locks it. The vault refuses to return a stake while any ballot it backs is still unreleased, so the same tokens can never back two counted ballots and a voter cannot sell what they voted with. Double-vote prevention became a property of where the tokens are rather than a rule about what the tally re-reads, which is why the re-clamp and the challenge window had nothing left to do. The swap itself went through the mechanism this page describes at the bottom. Proposal P-CAPER-7CD71F on the $CAPER (/wiki/foundations/what-is-a-caper) caper carried an UPGRADE option naming the new logic component, and its execution transaction (https://stokenet-dashboard.radixdlt.com/transaction/txid_tdx_2_1gyn66jhux2qcx7qgrfyt4e7m0pkq8yhymauqn6sgh3ghuk7culasxshjz3) called execute_proposal_upgrade and execute_proposal_upgrade_activate back to back on 16 August 2026 at 09:27:54 UTC. The registry (https://stokenet-dashboard.radixdlt.com/component/component_tdx_2_1czd3cm28fkq6f08c9y52w0tw56p4k6dz5h3uf76jrmpgm8a8ashuey) has pointed current_main at the new component ever since. Both calls fitted in one manifest because Stokenet's registry carries a zero upgrade delay; on a network with a non-zero delay the propose and the activate are separated by it.

Who pays to settle Every step after the cast window closes is permissionless, and permissionless work still costs gas. A large proposal's release path is not one transaction but hundreds. At three ballots a transaction, a thousand-ballot proposal is roughly 334 release calls plus one finalize, and none of it is contingent on the proposal passing. Leaving that bill with whoever happens to click Settle taxes one member for a public good the whole caper consumes. That is the default almost everywhere else. In OpenZeppelin's Governor (https://raw.githubusercontent.com/OpenZeppelin/openzeppelin-contracts/master/contracts/governance/Governor.sol) and in Compound's Governor Bravo (https://raw.githubusercontent.com/compound-finance/compound-protocol/master/contracts/Governance/GovernorBravoDelegate.sol) , execute is an ordinary payable function with no access control: anyone may call it once the proposal is queued, and the caller pays the gas from their own pocket with nothing coming back. In practice the proposer, a delegate or a bot absorbs it, and the cost appears in none of the governance ledgers surveyed in DAO governance operating costs (/wiki/dao-governance/concepts/analysis/dao-governance-operating-costs) . What that unpriced work costs when a DAO buys it from an automation vendor instead, and why it stays invisible when it does not, is on who pays to execute a passed proposal (/wiki/dao-governance/concepts/analysis/proposal-execution-costs) . A caper reimburses it instead. Each call draws up to 5 XRD from the treasury against a per-proposal allowance of 500 XRD, deliberately the same figure as the default proposal fee that proposal already paid into that same treasury, so a proposal funds its own settlement and can never cost the treasury more than it contributed. The allowance is one pool shared by the whole path: the batched cast transactions draw on it too, at up to 8 XRD each. At 5 XRD a release call it covers about a hundred of them, so a proposal past roughly three hundred ballots exhausts it and the remaining callers pay their own way. That degrades rather than bricks, and the vote fees banked at release, 100 XRD a ballot on the live contract, return far more to the treasury than the allowance can ever spend. The draw is a contingent fee lock, and that is load-bearing rather than a detail. A plain lock_fee credits the fee reserve immediately and survives an aborted transaction; a contingent lock never touches that balance (https://raw.githubusercontent.com/radixdlt/radixdlt-scrypto/main/radix-engine/src/system/system_modules/costing/fee_reserve.rs) and is charged only when the transaction commits. Without it, anyone could call a settle-path method, abort the transaction, and drain the treasury while the allowance counter rolled back every time. Because payment and allowance now move together, the worst a spammer gets is an allowance draining at the same rate real work would drain it. The draw rides each call's proposal read, so a release that finds nothing left to release still pays the keeper who ran it: honest work that happens to find nothing is still work. The allowance ledger itself lives in the immortal state tier beside the funds, while the budget and the per-call ceiling are logic-tier policy, so an UPGRADE (/wiki/governance/proposals) can retune what settlement costs without touching the record of what has already been spent.

Topic Carrying out a passed pr…(~10 min) → settle → execute AExecutive action kinds TEXT (legislative), PAYOUT, · INVEST, · DIVEST · VOTE, · UPGRADE ($CAPER only) Replay guards Two once-only …pts/voting/proposal-lifecycle)

Crystallize, settle, execute —…has no winner to execute, and TEXT winners are legislative — they carry no on-chain action at all (see Pa legislative proposals (/wiki/governance/proposals) )'s winner carries no on-chain action at all — so only executive winners reach this step.

The executive actions PAYOUT a… entire execution rolls back. DIVEST is INVEST run backwards, and it is the newest of the five. Execution withdraws the voted-on amount of the target caper's token from this treasury, sells it into that caper's curve (/wiki/markets/bonding-curve) , and deposits the XRD — again entirely inside the contract's own call frame, so the tokens never touch the worktop. Two guards ride it. The withdrawal aborts outright if the treasury's holding has fallen below the amount that passed, because executing a smaller trade than the one that was voted on would break the frozen-winner contract; and the sell asserts the bucket handed over is the target caper's own resource, so a stale address aborts rather than selling the wrong thing. The $XRD caper is excluded by name — it has no curve to sell into. Where INVEST fuses its guard and its withdrawal into one state-tier call, DIVEST composes two generic ones the immortal tier already exposes, paying an extra cross-package hop to avoid redeploying that tier; the whole action therefore shipped through the ordinary UPGRADE path with no per-caper migration. Its sell leg emits the same event an ordinary sale does, so it appears on the target caper's trade feed (/wiki/markets/trading) with no divest-specific arithmetic anywhere off-chain. UPGRADE is the one action rese…ather than under an admin key.

Where each action runs — state…cutor can redirect it. INVEST, DIVEST, VOTE and UPGRADE carry no acc…r the proposal ledger at risk.

The executive actions PAYOUT and INVEST each execute in a single call. PAYOUT transfers the chosen currency and amount out of the treasury to the stored, voted-on recipient. INVEST runs its whole withdraw → buy (/wiki/markets/bonding-curve) → deposit inside the contract's own call frame, so the treasury XRD it spends never touches the transaction worktop — a public executor cannot take part of the withdrawal and pocket the rest. The execution step asserts the bucket handed back is the target caper's token, in a positive amount, before it lands in the treasury. VOTE is split across several manifest instructions, because it must re-enter a separate component mid-transaction. A first call hands the manifest the target token, the XRD vote fee, and the treasury admin badge; the manifest presents that badge as a proof to authorise the treasury's vote into the target caper's proposal, routed through a fresh top-level frame; a final call returns the badge to its vault. Because the whole sequence is one atomic transaction, the admin badge never survives a transaction boundary outside the vault — if any step fails, the entire execution rolls back. UPGRADE is the one action reserved for the $CAPER (/wiki/foundations/what-is-a-caper) caper itself. Its winning option swaps the platform's live logic tier through the registry, in a two-phase propose-then-activate sequence — this is the mechanism by which the whole system upgrades itself under governance rather than under an admin key.

The executive actions PAYOUT and INVEST each execute in a single call. PAYOUT transfers the chosen currency and amount out of the treasury to the stored, voted-on recipient — by way of an account locker (https://docs.radixdlt.com/docs/locker) rather than a direct deposit, so a recipient whose account rejects the resource cannot abort the execution; the payment simply waits to be claimed. That, and the rest of the treasury's plumbing, is covered under raising funds (/wiki/markets/raising-funds) . INVEST runs its whole withdraw → buy (/wiki/markets/bonding-curve) → deposit inside the contract's own call frame, so the treasury XRD it spends never touches the transaction worktop — a public executor cannot take part of the withdrawal and pocket the rest. The execution step asserts the bucket handed back is the target caper's token, in a positive amount, before it lands in the treasury. VOTE is split across several manifest instructions, because it must re-enter a separate component mid-transaction. A first call hands the manifest the target token, the XRD vote fee, and the treasury admin badge; the manifest presents that badge as a proof to authorise the treasury's vote into the target caper's proposal, routed through a fresh top-level frame; a final call returns the badge to its vault. Because the whole sequence is one atomic transaction, the admin badge never survives a transaction boundary outside the vault — if any step fails, the entire execution rolls back. UPGRADE is the one action reserved for the $CAPER (/wiki/foundations/what-is-a-caper) caper itself. Its winning option swaps the platform's live logic tier through the registry, in a two-phase propose-then-activate sequence — this is the mechanism by which the whole system upgrades itself under governance rather than under an admin key.

The executive actions PAYOUT a…served for the $CAPER (/wiki/caper/CAPERfoundations/what-is-a-caper) caper itself. Its winning o…ather than under an admin key.

Who pays to settle Every step…-governance-operating-costs) . What that unpriced work costs when a DAO buys it from an automation vendor instead, and why it stays invisible when it does not, is on who pays to execute a passed proposal (/wiki/dao-governance/concepts/analysis/proposal-execution-costs) . A caper reimburses it instea…f what has already been spent.

Topic Carrying out a passed pr…ags — settled, then executed Settlement gas Treasury-reimbursed — up to 5 XRD per call against a 500 XRD per-proposal allowance Related Proposals (/wiki/gove…pts/voting/proposal-lifecycle)

Who pays to settle Every step after voting closes is permissionless, and permissionless work still costs gas. A large proposal's settle path is not one transaction but dozens — a thousand-ballot proposal runs roughly fourteen crystallize chunks, roughly fourteen reclamp sweeps and a settle, at the contract's 75-ballot chunk size — and none of it is contingent on the proposal passing. Leaving that bill with whoever happens to click Settle taxes one member for a public good the whole caper consumes. That is the default almost everywhere else. In OpenZeppelin's Governor (https://raw.githubusercontent.com/OpenZeppelin/openzeppelin-contracts/master/contracts/governance/Governor.sol) and in Compound's Governor Bravo (https://raw.githubusercontent.com/compound-finance/compound-protocol/master/contracts/Governance/GovernorBravoDelegate.sol) , execute is an ordinary payable function with no access control: anyone may call it once the proposal is queued, and the caller pays the gas from their own pocket with nothing coming back. In practice the proposer, a delegate or a bot absorbs it, and the cost appears in none of the governance ledgers surveyed in DAO governance operating costs (/wiki/dao-governance/concepts/analysis/dao-governance-operating-costs) . A caper reimburses it instead. Each settle-path call draws up to 5 XRD from the treasury against a per-proposal allowance of 500 XRD — deliberately the same figure as the default proposal fee that proposal already paid into that same treasury, so a proposal funds its own settlement and can never cost the treasury more than it contributed. The allowance covers the measured thousand-voter path around four times over; past it the draw returns zero and the caller pays, so an unusually large proposal degrades rather than bricks. The per-call figure is a ceiling, not a charge: the engine refunds whatever a lock does not consume. The draw is a contingent fee lock, and that is load-bearing rather than a detail. A plain lock_fee credits the fee reserve immediately and survives an aborted transaction; a contingent lock never touches that balance (https://raw.githubusercontent.com/radixdlt/radixdlt-scrypto/main/radix-engine/src/system/system_modules/costing/fee_reserve.rs) and is charged only when the transaction commits. Without it, anyone could call a settle-path method, abort the transaction, and drain the treasury while the allowance counter rolled back every time. Because payment and allowance now move together, the worst a spammer gets is an allowance draining at the same rate real work would drain it. Where the draw rides differs by entry point, and the difference is deliberate. Settle and reclamp gas their read, so a sweep that finds nothing to ratchet down still pays the keeper who ran it — honest work that happens to find nothing is still work. Crystallize gasses its write, so calling it again once the tally is already complete writes nothing and draws nothing. The allowance ledger itself lives in the immortal state tier beside the funds, while the budget and the per-call ceiling are logic-tier policy: an UPGRADE (/wiki/governance/proposals) can retune what settlement costs without touching the record of what has already been spent.

Topic Carrying out a passed pr…osal Timeline Voting closes → crystallize (chunked tally) → execution delay (~10 min) → settle (re-tally) → execute Action kinds TEXT …pts/voting/proposal-lifecycle)

Once a proposal's voting window closes and its execution delay has elapsed (roughly ten minutes by default), resolution happens in two public steps: anyone can first settle the proposal — an on-chain re-tally that, resolution happens in public steps anyone can run: crystallize the ballots — fold them into an on-chain running count, in as many chunked transactions as the turnout needs, with no cap on how many members may vote — then, once the execution delay has elapsed (roughly ten minutes by default), settle the proposal to freezes the winner — and thenfrom that count, and finally submit the transaction that executes thate winning option. The delay is …ore an executive action lands.

Settle, thenCrystallize, settle, execute — two once-only guards Resolution is split across two callsguarded at every step: the tally cursor only moves forward, each withballot its own replay guard, socounted exactly once, and a proposal can never be tallisettled twice or executed twice. Settle. Settling re-runs the whole balloCrystallize. Anyone can fold the next chunk of ballots into a persistent on-chain count. Each ballot carries a vote … a last choice counts nothing. The weight's holdings term is clamped to the smaller of what the voter held when they voted and what they hold now, and until settlement anyone can re-observe a counted ballot and ratchet its credit further down if that stake has since moved — selling after voting only ever shrinks a vote. Because the count persists across transactions, turnout has no ceiling. Settle. Settling reads the finished count and freezes the winner. The option with the greatest …osal finalizes with no winner. A count completed in a single pass after the execution delay elapsed settles immediately; any other count must first wait out a one-hour challenge window in which anyone can re-check its ballots. This step flips a settled fla…utive winners reach this step.

The executive actions PAYOUT a…awal and pocket the rest. The settlingexecution step asserts the bucket hande…ather than under an admin key.

Topic Carrying out a passed proposal Timeline Voting closes → execution delay (~10 min) → execution opens Executive actions PAYOUT and INVEST — single call; VOTE — multi-step manifest Related Proposals (/wiki/governance/proposals) , Voting (/wiki/governance/voting) , Proposal lifecycle (/wiki/daos/concepts/voting/proposal-lifecycle)

Once a proposal's voting window closes and its execution delay has elapsed (roughly ten minutes by default), anyone can submit the transaction that carries out the winning option. The delay is a deliberate pause between the decision and the act — the same role a timelock plays in mainstream DAO governance (/wiki/daos/concepts/voting/proposal-lifecycle) , giving members a window to react before an executive action lands.

The resolve gate Execution first re-tallies the ballot on-chain and checks that the leading option cleared the 1.5 / N supermajority. If it did not — or if the no-execution option won — the proposal simply finalizes with no action. A proposal can be resolved only once.

Single call vs multi-step TEXT options are legislative — they carry no on-chain action, so there is nothing to execute. A winning TEXT proposal stands as a recorded signal (see Proposals (/wiki/governance/proposals) ); only executive options reach the treasury. PAYOUT and INVEST each execute in a single call. PAYOUT transfers the chosen currency and amount out of the treasury. INVEST runs its whole withdraw → buy (/wiki/markets/bonding-curve) → deposit inside the contract's own call frame, so the treasury XRD it spends never touches the transaction worktop — a public executor cannot take part of the withdrawal and pocket the rest. The settling step asserts the bucket handed back is the target caper's token, in a positive amount, before it lands in the treasury. VOTE is the one action split across several manifest instructions, because it must re-enter a separate component mid-transaction. A first call hands the manifest the target token, the XRD vote fee, and the treasury admin badge; the manifest presents that badge as a proof to authorise the treasury's vote into the target caper's proposal, routed through a fresh top-level frame; a final call returns the badge to its vault. Because the whole sequence is one atomic transaction, the admin badge never survives a transaction boundary outside the vault — if any step fails, the entire execution rolls back.

Hand-rolling an executor manifest If you ever build an executor manifest by hand, end it with a try_deposit_*_or_abort: the Radix Engine's General transaction classifier only whitelists the _or_abort deposit variants, and the _or_refund forms make the wallet display a "Complex transaction" warning instead of a clean summary.

Topic Carrying out a passed proposal Timeline Voting closes → execution delay (~10 min) → settle (re-tally) → execute Action kinds TEXT (legislative), PAYOUT, INVEST, VOTE, UPGRADE Replay guards Two once-only flags — settled, then executed Related Proposals (/wiki/governance/proposals) , Voting (/wiki/governance/voting) , Voting mechanisms (/wiki/governance/voting-mechanisms) , Proposal lifecycle (/wiki/dao-governance/concepts/voting/proposal-lifecycle)

Once a proposal's voting window closes and its execution delay has elapsed (roughly ten minutes by default), resolution happens in two public steps: anyone can first settle the proposal — an on-chain re-tally that freezes the winner — and then submit the transaction that executes that winning option. The delay is a deliberate pause between the decision and the act — the same role a timelock plays in mainstream DAO governance (/wiki/dao-governance/concepts/voting/proposal-lifecycle) , giving members a window to react before an executive action lands.

Settle, then execute — two once-only guards Resolution is split across two calls, each with its own replay guard, so a proposal can never be tallied twice or executed twice. Settle. Settling re-runs the whole ballot on-chain. Each ballot carries a vote weight (/wiki/governance/voting) , and that weight is spread across the options the ballot ranked: an option placed at rank i receives (N − 1 − i) times the voter's weight, so a first choice counts most and a last choice counts nothing. The option with the greatest summed weight wins only if its share of the total weight cleared the 1.5 / N supermajority and it is not the no-execution option; otherwise the proposal finalizes with no winner. This step flips a settled flag and can run only once. Execute. With a winner frozen, execution flips a separate executed flag — the guard that stops the same winning action from being replayed. A settled proposal that did not pass has no winner to execute, and TEXT winners are legislative — they carry no on-chain action at all (see Proposals (/wiki/governance/proposals) ) — so only executive winners reach this step.

The executive actions PAYOUT and INVEST each execute in a single call. PAYOUT transfers the chosen currency and amount out of the treasury to the stored, voted-on recipient. INVEST runs its whole withdraw → buy (/wiki/markets/bonding-curve) → deposit inside the contract's own call frame, so the treasury XRD it spends never touches the transaction worktop — a public executor cannot take part of the withdrawal and pocket the rest. The settling step asserts the bucket handed back is the target caper's token, in a positive amount, before it lands in the treasury. VOTE is split across several manifest instructions, because it must re-enter a separate component mid-transaction. A first call hands the manifest the target token, the XRD vote fee, and the treasury admin badge; the manifest presents that badge as a proof to authorise the treasury's vote into the target caper's proposal, routed through a fresh top-level frame; a final call returns the badge to its vault. Because the whole sequence is one atomic transaction, the admin badge never survives a transaction boundary outside the vault — if any step fails, the entire execution rolls back. UPGRADE is the one action reserved for the $CAPER (/wiki/caper/CAPER) caper itself. Its winning option swaps the platform's live logic tier through the registry, in a two-phase propose-then-activate sequence — this is the mechanism by which the whole system upgrades itself under governance rather than under an admin key.

Where each action runs — state tier vs logic tier A caper (/wiki/foundations/what-is-a-caper) 's contract is split into an immortal state tier that holds the treasury and the durable proposal record, and a swappable logic tier that carries the math and the executive plumbing. Which tier performs a winner depends on what the action touches. PAYOUT executes inside the state tier, because the voted-on recipient is a Global<Account> that only stays invokable as a stable substate reference — it cannot be handed to the logic tier and called there. The state tier therefore performs the transfer to the stored recipient itself, and no executor can redirect it. INVEST, VOTE and UPGRADE carry no account reference, so the logic tier drives them, reading back only the frozen typed option from state. That division is why an upgrade can replace the entire logic tier without ever putting the treasury or the proposal ledger at risk.

Hand-rolling an executor manifest If you ever build an executor manifest by hand, end it with a try_deposit_*_or_abort: the Radix Engine's General transaction classifier only whitelists the _or_abort deposit variants, and the _or_refund forms make the wallet display a "Complex transaction" warning instead of a clean summary.

Topic Carrying out a passed pr… Proposal lifecycle (/wiki/daos/concepts/voting/proposal-lifecycle)

Once a proposal's voting windo…ream DAO governance (/wiki/daos/concepts/voting/proposal-lifecycle) , giving m…ore an executive action lands.

Topic Carrying out a passed pr… (~10 min) → execution opens One transaction TEXT, PAYOUT Two-phase INVEST, VOTEExecutive actions PAYOUT and INVEST — single call; VOTE — multi-step manifest Related Proposals (/wiki/go…o/concepts/proposal-lifecycle)

One transaction vs two-phase For TEXT and PAYOUT,Single call vs multi-step TEXT options are legislative — they carry no on-chain action, so there is nothing to execute. A winning TEXT proposal stands as a recorded signal (see Proposals (/wiki/governance/proposals) ); only executive options reach the treasury. PAYOUT and INVEST each executione isn a single call: the manifest invokes the relevant treasury method and finalizes the proposal. INVEST and VOTE are split across two top-level frames in one manifest. PAYOUT transfers the chosen currency and amount out of the treasury. INVEST runs its whole withdraw → buy (/wiki/markets/bonding-curve) → deposit inside the contract's own call frame, so the treasury XRD it spends never touches the transaction worktop — a public executor cannot take part of the withdrawal and pocket the rest. The settling step asserts the bucket handed back is the target caper's token, in a positive amount, before it lands in the treasury. VOTE is the one action split across several manifest instructions, because eachit must hand assets or a badge to a foreign component mid-transaction: - A phase-1 call returns the buckets and badges required (e.g. XRD from the treasury for INVEST, or the treasury admin badge for VOTE). - A middle step invokes main.buy_token (INVEST) or DaoTre-enter a separate component mid-transaction. A first call hands the manifest the target token, the XRD vote fee, and the treasury admin badge; the manifest presents that badge as a proof to authorise the treasury.'s vote_via_main (VOTE) in a fresh frame. - A into the target caper's proposal, routed through a fresh top-level frame; a finishal call srettles state and emits the executed event. For VOTE, the treasury admin badge is returned to the treasury vault before this step endsurns the badge to its vault. Because the whole sequence is one atomic transaction, the admin badge never survives a transaction boundary outside the vault — if any step fails, the entire execution rolls back.

Topic Carrying out a passed proposal Timeline Voting closes → execution delay (~10 min) → execution opens One transaction TEXT, PAYOUT Two-phase INVEST, VOTE Related Proposals (/wiki/governance/proposals) , Voting (/wiki/governance/voting) , Proposal lifecycle (/wiki/dao/concepts/proposal-lifecycle)

Once a proposal's voting window closes and its execution delay has elapsed (roughly ten minutes by default), anyone can submit the transaction that carries out the winning option. The delay is a deliberate pause between the decision and the act — the same role a timelock plays in mainstream DAO governance (/wiki/dao/concepts/proposal-lifecycle) , giving members a window to react before an executive action lands.

The resolve gate Execution first re-tallies the ballot on-chain and checks that the leading option cleared the 1.5 / N supermajority. If it did not — or if the no-execution option won — the proposal simply finalizes with no action. A proposal can be resolved only once.

One transaction vs two-phase For TEXT and PAYOUT, execution is a single call: the manifest invokes the relevant treasury method and finalizes the proposal. INVEST and VOTE are split across two top-level frames in one manifest, because each must hand assets or a badge to a foreign component mid-transaction: - A phase-1 call returns the buckets and badges required (e.g. XRD from the treasury for INVEST, or the treasury admin badge for VOTE). - A middle step invokes main.buy_token (INVEST) or DaoTreasury.vote_via_main (VOTE) in a fresh frame. - A finish call settles state and emits the executed event. For VOTE, the treasury admin badge is returned to the treasury vault before this step ends.

Hand-rolling an executor manifest If you ever build an executor manifest by hand, end it with a try_deposit_*_or_abort: the Radix Engine's General transaction classifier only whitelists the _or_abort deposit variants, and the _or_refund forms make the wallet display a "Complex transaction" warning instead of a clean summary.