ADR-0006: 100 ms confirmations: accountable, then covered

Product wants "100 ms settlement." Physics: nothing lands on Solana inside one ~400 ms slot ⟨VERIFY⟩, and withdrawable finality is bounded below by L1 rooting (~13 s ⟨VERIFY⟩) plus the proof system. So the 100…

Status: proposed. Dated 2026-08-15.

Status: proposed (2026-08-15) · Prompt: §6 C2, App. E2 · Builds on: solieum-receipt (Step 7), ADR-0003/0004

Context

Product wants "100 ms settlement." Physics: nothing lands on Solana inside one ~400 ms slot ⟨VERIFY⟩, and withdrawable finality is bounded below by L1 rooting (~13 s ⟨VERIFY⟩) plus the proof system. So the 100 ms rung must be engineered as user-irreversibility (S1) — an enforceable, insured confirmation — while S2 (anchored) and S3 (withdrawable) are compressed separately and never conflated with it.

Decision

  1. Micro-block sealing. The sequencer seals L2 micro-blocks on a fixed 50 ms cadence. A receipt refers to a sealed block hash and position, not a mempool ack.
  2. Receipts stay the base layer (already built): signed {order_hash, market/lane, block, position, l2_slot}; double-assignment or a published batch contradicting a held receipt is provable equivocation → slash (solieum-receipt's two proofs).
  3. Coverage on top. A receipt MAY carry covered_up_to: Lamports, backed by a dedicated on-chain coverage bond (separate from the proposer bond; hard collateral per ADR-0003).
    • Exposure accounting: the sequencer tracks rolling exposure = Σ covered value on receipts whose blocks are not yet S2-anchored at confirmed ⟨policy: confirmed vs finalized — see Open⟩. Admission is fail-closed: when headroom is exhausted, further receipts are issued uncovered and say so (covered_up_to: 0); never silently covered.
    • Sizing inequality (the whole scheme): coverage_bond ≥ peak_TPS × avg_covered_value_per_tx × S2_latency_p99 × safety_factor. Faster anchoring (smaller S2 window) linearly reduces the capital the promise needs — the pipeline work below is what makes 100 ms coverage affordable.
    • Claims: holder submits receipt + equivocation/exclusion proof to the L1 coverage program → automatic payout up to covered_up_to, no discretion, pause cannot block a proven claim (exits-page rule extends here).
  4. S2 pipeline target: post one batch frame per L1 slot (continuous streaming), multi-path submission, priority-fee escalator with a published congestion playbook. Targets: S2 p50 ≤ 1.5 s, p99 published, never advertised as fixed.
  5. Language rule (site + docs): the shipped phrase is "100 ms accountable confirmation" or "insured up to X" — the bare phrase "100 ms settlement" is banned exactly as "200 ms finality" was (§4.2-class vocabulary rule).
  6. Geography is disclosed: 100 ms is a same-region ingress promise; cross-continent RTT alone can exceed it. Publish per-region p50/p99 for ack→sealed; no global single number.

Consequences

  • New on-chain program: coverage vault + claim instruction (needs ed25519 receipt verification on-chain — precompile cost ⟨VERIFY⟩ gates the claim-tx design).
  • solieum-receipt grows coverage fields + exposure-accounting + claim-verdict functions (pure, std-only, testable like everything else).
  • solieum-batch's sustainable_tps/cost model couples in: coverage headroom is a function of anchor cadence the batcher actually sustains.
  • Verifier (Step 8) gains the receipt-vs-batch cross-check and an auto-claim generator — watchtowers get paid twice: challenges and coverage claims.

Reversal triggers

Coverage bond underwater vs exposure at any TVL review → cut coverage caps automatically (fail closed). Multi-prover live and S3 in minutes → revisit whether coverage is still worth its capital at all.

Open (decide before implementation)

  • Exposure release at L1 confirmed vs finalized: confirmed frees ~10× capital, accepts reorg-window risk on coverage accounting ⟨quantify with L1 reorg data⟩.
  • Per-lane vs global coverage pools (markets appendix wants per-market lanes).
  • Who may top up the bond mid-epoch, and the timelock on withdrawals from it.