# Operator signing and payouts Public workspace: https://thesolstice.net/operators/. Access to the page grants no on-chain authority. Every action checks the deployed release and fixed signing wallets. The mainnet program is not deployed; local tests are not an independent review or an actual-wallet acceptance test. ## First-market preparation Use the dedicated project wallet `GXFPRx4LizCCmiqKFR1dsE4BJe5VkefFcjhh2THbDhTQ`. Fill in actual operators/reviewers/backups and keeper addresses in `/admin/`, obtain their consent, agree on policies, and fund their relevant fee-paying wallets. Distinct public keys do not establish independent people or availability. Keep private keys in each owner's wallet. The supported coin must use plain native SOL and legacy SPL tokens with revoked mint/freeze powers. Initial routing must finish before graduation. Finalized Pump fee routing is permanent and exceeds a single seven-day stream. Creation starts the 24-hour funding clock even though the stream starts paused. Complete collateral, policies and binding before explicitly opening commitments. ## Shared transaction approval 1. Connect the fee-paying wallet. Prepare an action or load an operator request. Buybacks use the pinned operator as payer; fee reports/recovery use a pinned reviewer; holder publication uses its pinned publisher. 2. Review amounts, recipients, source evidence and required wallets. Approve in the wallet. The page saves the partial transaction and downloads a public approval file; signing does not broadcast it. 3. Give that file to the second signer. They load it, recheck current state, independently verify evidence, and add their approval. The page retains original verified peer signatures even if a wallet omits them. 4. Load the completed file, recheck, then select **Submit complete transaction**. The page verifies signatures, simulates, persists the exact signed bytes, and submits. 5. Keep the original signature until finality. Check saved approvals/Explorer after a timeout. Retrying sends identical bytes. Do not automatically replace a complete transaction with uncertain confirmation. Have both signers available together. Reviews last at most 90 seconds; blockhashes or the 150-slot buyback quote may expire sooner. A refreshed transaction requires every signature again. Partial-expiry status requires finalized block height beyond the last valid height. If a peer might have submitted the complete copy, check the original payer signature first. Completed signed files can be submitted by anyone holding them until expiry. The page does not host or message approval files. Storage failure blocks progress; browser storage is finite and can be cleared. Download recovery copies and preserve exact public evidence. Never put secrets in an approval or payout file. ## Buybacks and fixed payouts The operator first prepares token accounts and missing Pump volume accounts. For PumpSwap, fund its own wrapped-SOL account to the policy cap. Trading capital is separate from stream commitments. The operator fronts purchases; reimbursement follows the verified purchase and burn. Rent and network fees are additional. An explicit action returns remaining wrapped SOL to that same operator. Enter a current quote: market, canonical Pump buyback fee recipient, maximum input lamports and minimum token base units. The page reads the replay sequence and pins price/expiry. Both wallets must approve. Curve-completing trades remain unsupported and revert. After the grace period, unused buyback budgets become original underwriters' credits. The platform/keeper buttons pay only the saved recipients. After the final fee report, the stream page settles and underwriters claim their own credits. Preserve permanent stream links for completed weeks. ## Fee reports Keep the finalized archival scanner current from its original anchor. Use the existing fee-history scan/report commands after collecting and reconciling curve/pool fees and external distributions. Missing coverage is not zero revenue. Each reviewer independently runs: ```powershell node scripts/fee-history.mjs verify node scripts/prepare-operator.mjs fee-report ``` Compare the printed complete-evidence digest and report. The second command writes a request into `.data/operator-requests/`; load it in `/operators/`. The request carries a report and evidence digest, not the full block archive. Browser checks bind it to the current term, route, balances and reviewers; they do not prove historical RPC truth. Both reviewers independently verify the complete history before signing. After the fixed delay, both backups can approve recovery, then review a report covering the recovery slot. ## Holder proof publication Prepare a fresh complete holder snapshot using `scripts/holder-payout.mjs prepare `. It must reconcile the entire supply at one finalized slot and use the configured policy. Then run: ```powershell node scripts/prepare-operator.mjs holder-publication node scripts/build.mjs node scripts/build-hosting.mjs ``` This stages the verified file in `public-proofs/.json`. Publish the hosting checkout through the existing authenticated Sites source/version/deploy workflow, preserving its project ID and public audience. The build reconstructs all files, copies them to `/proofs/`, and lists them on `/payouts/`. Keep old files while claims remain and retain independent backups of this public archive. After the file is public, load the generated request in `/operators/`. The browser reconstructs all allocations, checks the public file digest and on-chain policy/budget, and prepares funding. Snapshots must remain within 512 slots at execution. If publication or signing is too slow, capture a new snapshot, publish its new file, and obtain fresh approval. This static workflow requires an operator to publish each proof; it is not an automatic daily uploader. Never fund an unavailable or stale root. Holders download their complete file on `/payouts/` and claim through `/streams/`, which checks on-chain roots, amounts and permanent receipts. After the recovery delay, both holder backups can switch the publisher without changing previous roots or claims. No preparation script deploys to public devnet or submits real funds. Mainnet deployment, actual-wallet testing, operator consent, independent review and the first supported coin remain launch requirements.