Getting out

A censoring sequencer is not a hypothetical — it is the default failure mode of a single operator. Forced inclusion removes it as a permanent condition: submit your transaction directly to a Solana program, and if the sequencer has not included it within a fixed maximum delay, the chain's own derivation rules include it whether the operator cooperates or not.

• Submission goes to Solana, so the sequencer cannot block the route.
• A hard maximum delay, after which inclusion is mandatory rather than discretionary.
• The queue and its age are public, so censorship is visible as it happens.
• This is what makes a centralised sequencer survivable rather than custodial.

Where this actually stands: the Solana program you submit to now exists, and the properties that make it a route rather than a courtesy are tested. Submitting takes no permission and does not involve the sequencer's key at all. Your inclusion deadline is fixed on-chain from the cluster clock at the moment you submit, and nobody can edit it afterwards. If your transaction is ignored past that deadline you take your fee back yourself, without the sequencer's cooperation — so being censored costs the operator the fee and costs you nothing — and a late inclusion is stamped late permanently rather than tidied up. The enforcement half is wired to it: an entry left past its deadline while the operator keeps posting batches makes their chain stop deriving — a fault naming the offending batch and the entry it skipped, while everything before it still stands. That is tested with both halves read back from on-chain records rather than from hand-made fixtures, so ignoring a transaction costs the operator the fee and invalidates their chain. The node now drains this queue as part of producing every block: it reads the entries off Solana, executes them, records each inclusion on-chain, and declares in the posted batch exactly how far it consumed — the number the derivation rule checks. Two things were forced by wiring that, and both are worth knowing. The transaction bytes now live on the queue entry itself rather than being hashed and kept elsewhere, because a sequencer can always claim it never received bytes it cannot be shown to have — a commitment nobody can open is not a forced transaction. And an entry that turns out to be junk, unsigned, or unpayable is still consumed and still counted, published as a record of its own; otherwise anyone could freeze the chain for the price of one fee by queueing garbage. Forced inclusion promises a slot, not a successful transaction. Measured: a transfer submitted only to Solana landed in the next block, and three adversarial entries — junk, an unfunded signer, a valid transfer behind them — were all consumed with balances changed by exactly the valid one. Where it is: the inbox program is deployed on Solana devnet, and the node settling there drains it every block. What is still missing is the part no test can supply — nobody outside the team has used it, and the convenience command that submits for you pays the Solana fee from the node's own wallet, so it demonstrates the drain rather than the independence. It is a route that works and is deployed, not yet a route in use by anyone independent.

If Solieum stops entirely — the sequencer is gone, the operator is unreachable, the company no longer exists — you prove what you own against the last final state root and withdraw on Solana. No cooperation required, no permission asked.

• Proven against the last final root, using publicly available data.
• Executable with public tools by someone with no relationship to the team.
• Rehearsed in a public drill by an unaffiliated user — an exit path nobody has ever used is a claim, not a feature.

Where this actually stands: the on-chain side exists and works. A program verifies a Merkle proof of your withdrawal against a state root that is final on Solana, checks that the proof commits to your exact amount and recipient, and pays out — with no involvement from the operator, and with the payout callable by anyone. It is demonstrated end to end against the settlement program, including that an inflated claim riding a genuine proof is rejected. Where it stands on devnet: deposits are credited in the next block, and the first withdrawal has been initiated — an ordinary signed transaction to the reserved L2 bridge address debited the sender and committed the withdrawal leaf into block 7 of the alpha chain, whose root is on Solana under bond, and again into block 3 of the beta chain on 2026-09-05. The proofs exist, sparse ones on the beta chain, and on 2026-09-07 the beta chain's first withdrawal was paid by the vault: proven against its root once final, held by the air gap, then paid — every step on Solana's public devnet. By the time beta stopped on 2026-09-12, all four of its withdrawals, 14,000,000 lamports, had been proven and paid, and it owed nothing. The alpha chain's first withdrawal still waits on the seven days it was created with. That, and public tooling for building your own proof, remain the open items. Until an unaffiliated person has done that in a drill, treat this as mechanism built rather than exit proven.