• The question nobody else answers
• Why it’s a deliberate design choice
• How it actually works
• Why a year and why it protects the lender too
• A fire escape, not a side door

Last time we covered why Surge runs on Taproot: a dead key path, a NUMS key you can recompute yourself, and three spending paths committed in the open. We called one of them the path that matters most and moved on. This is the zoom-in on that path, the Exit leaf, where “non-custodial” stops being a claim and becomes something Bitcoin itself enforces.

§The question nobody else answers

Not “what happens if you default.” Not “what happens if the market crashes.” Those have answers. The real one is worse:

What happens to your Bitcoin if we disappear?

Not insolvent-but-still-answering-emails. Gone. Servers off, team scattered, no one left to approve a withdrawal. For almost every platform that has ever held Bitcoin against a loan, the honest answer is that your coins were only ever as recoverable as the company was alive to return them.

That’s the quiet dilution of “non-custodial.” It came to mean we let you withdraw, and letting you is a permission, which needs someone around to grant it. A withdrawal button is a promise. We wanted a hard guarantee.

§Why it’s a deliberate design choice

The Exit leaf isn’t a feature we added at the end. It’s the constraint the rest of the vault was built around.

Self-custody only means something if your control survives the failure of every other party, including ours. So we designed backwards from the failure case: assume Surge is gone, the signing network is gone, there’s no one to ask. Your Bitcoin still has to come home. The industry mostly runs this the other way, where your exit depends on the platform’s cooperation, which means it was never really yours.

§How it actually works

This is the technical core. If opcodes aren’t your thing, skip ahead, you won’t lose the thread.

A Surge Vault is a single Pay-to-Taproot output, and it can only move through one of three committed script paths. Exit is the third:

• It enforces OP_CHECKSEQUENCEVERIFY : a relative timelock of roughly one year.

• After that, the path requires exactly one signature: yours. Not ours alongside yours. Not the network’s. Yours, alone.

• The vault’s internal key is a NUMS point with no usable private key, so there’s no shortcut around this leaf and no hidden path beside it.

In plain terms: if the coordination layer ceased to exist tomorrow, you wait out the timelock and spend your collateral back to yourself, directly on Bitcoin, with nothing but your own key. No portal, no support ticket, no trusting we kept our word, because the word is enforced by script, not by us being around to honor it.

§Why a year and why it protects the lender too

This is the part that’s easy to misread, so plainly: unilateral exit does not act against lenders. It’s not a way to walk away from a debt. The timelock is what makes sure of that.

A year isn’t arbitrary, it’s the default term of the credit line. Unlike platforms that lock you into a fixed duration up front, Surge runs flexibly across that year:

• Repay whenever you want : no early-closure penalty.

• Draw what you need, when you need it : it’s a credit line, not a lump sum.

• At term, you decide : renew with your signature, or close by repaying.

Exit is pinned to that same clock. So it can’t fire during the healthy life of the line, Repayment and Liquidation govern everything while the system is running. Exit only opens at the horizon where the term is already over and a working system would have required you to renew or repay anyway. The lender is protected by the same clock that protects you.

What it guarantees is narrow and crucial: in the catastrophe case, with no one left to coordinate, your collateral isn’t held hostage by a counterparty that no longer exists. The script just returns your Bitcoin. That isn’t dodging an obligation, it’s what’s left of the contract when one side has vanished.

§A fire escape, not a side door

• Repayment is the front door : cooperative, quick, how a healthy line closes.

• Liquidation is the rule everyone agreed to : triggered by a collateral breach or end-of-term delinquency, not anyone’s discretion.

• Exit is the fire escape : not for ordinary days, but the day the building is on fire, it opens from the inside, every time, without asking anyone.

A fire escape the landlord has to unlock isn’t a fire escape. That’s the inversion the industry skipped, and it’s the most genuinely Bitcoin thing about Surge: control that doesn’t depend on trust, recovery that doesn’t depend on permission, a guarantee written in script instead of a terms-of-service document that assumes we still exist.

So don’t trust that we’ll let you withdraw. Verify that you can leave without us. The full vault spec, the timelock, the leaf, the NUMS key, is at https://docs.surge.credit/tech/vaults. All readable. All yours to check.

Don’t trust. Verify. 🟧