The code and user base (the two most valuable parts of a startup) will still exist and could still be ported to another hardware architecture.
anything to do with your code that stores data, interfaces with external data / services, runs new threads etc pretty much everything that makes it useful, cannot be ported, by 'hardening' the language sandbox, they tie you into their api. their query language is even google specific.
any application written on this platform looks to need to be entirely rewritten from scratch to port to another architecture
I wonder, though -- what if you used something like a remote REST interface to do authentication, passing MD5'ed or SHA'ed passwords as one of the arguments, and then based auth on that? Google wouldn't like it, but technically it appears to be within the scope of the TOS.
Very, very good point, though... users and data are basically the only things that matter for this type of application.
I did find one of your other points spurious, though:
their query language is even google specific.
Oh for crying out loud -- if you can't write a Perl one-liner to convert every instance of GQL to SQL with bind variables, or if you don't already use placeholders in any instance of raw SQL in your own code, you've got worse problems than that. This is the least of the problems IMHO.
Something has occurred to me regarding NumPy, SciPy, R, etc. Since it's Google's CPU time, it's not my problem if a loop or matrix calculation is inefficient. I'm going to deploy some grad students to stress test their TOS... :-)
Probably not, but again, you don't necessarily have to use the bits that lock you in :-)
Nothing new under the sun here...