| Budget | One funded ceiling — a Control ledger record, an escrow deposit, or a card authorization — fanned out into streams. The parent object of a session |
| Stream (allowance) | A capped, revocable, per-second child allowance of a budget, aimed at exactly one service node. Streams delegate recursively; a subtree can never outspend its parent's cap |
units | The metered quantity. Deliberately payload-neutral: tokens, words, bytes, calls, minutes — the protocol prices work, whatever the work is |
| serviceNode | A payee: the address work streams to. Also deliberately payload-neutral |
| Rate envelope | The per-second accrual bound on a stream. Allowance accrues at rate × elapsed; a tick that outruns it fails closed |
| Voucher | A monotonic EIP-712 record of cumulative billed work, signed by the stream's scoped session key. Billing truth is the last SIGNED voucher |
| Session key | The scoped signing key behind one stream's vouchers. Leak blast radius = that stream's remaining cap |
| Allowance credential | An offline-verifiable JWS proving a live, capped allowance aimed at a specific service node — the request-path material gateways verify in-process |
| Checkpoint | Submission of the last signed voucher to the settlement layer (on-chain settle, card capture, ledger entry) |
| Finality | The settlement state after which funds are the payee's. Reached when the holdback window closes (or per chain confirmations) |
| Holdback | The per-stream window during which settled funds stay reachable for rule-based refunds. Default 300 seconds or the SLA window |
| Break-point | The attested instant from which degraded/failed units stop being payable. Refunds clip the settlement envelope from the break-point |
| Control Mode | The no-money funding mode: full enforcement machinery over a ledger backend. The recommended starting point for every integration |
| Escrow | The on-chain funding mode: the budget cap deposited in the vault contract, settled per-voucher, released at close |
| Card authorization-backed budget | The card funding mode: one manual-capture authorization is the ceiling; captures follow vouchers; the remainder releases at close |
| Revocation | Instant, structural termination of a stream and its whole delegated subtree. Post-revocation vouchers are unsettleable |
| Halt | A fail-closed stop with an objective reason code (cap, rate, anomaly, sla, revoked, exposure, ceiling_dead, …). A halted action bills nothing |
| Objective facts | Measurable, signed, reproducible quantities (latency, error rate, availability, unit counts, completion, acceptance events). The only signals settlement acts on |
| Oracle attestation | A signed statement of objective facts about a stream's service window, ingested fresh and in-band; missing or stale attestations fail closed |
| Verified-value settlement | Settlement conditioned on objective-fact attestations against declared SLA thresholds — throttle, halt, break-point, refund |
| Fee netting | Recovery of reversed fees from the payee: settled balance first, then negative-balance IOU against future settlements |
| Evidence bundle | A portable, offline-verifiable export of one session: every signed artifact, settlement reference, and Σ proof, with a digest manifest (evidence/1.0.0) |
| Σ proof | The re-derivable inequality chain: Σ child settlements ≤ funded ceiling, fee rows explicit, finality states per unit range |
| x402 | The HTTP 402 payment-challenge convention: a machine-readable challenge answered by an X-PAYMENT header, in exact (discrete) or dynamo-allowance (streaming) scheme |
| Session | The reconciled aggregate of one budget's lifetime: per-stream totals, settlement records, refunds, fees — engine equal to settlement layer, to the unit |
| Reconciliation | The end-of-session equality check between engine accounting and settlement-layer truth. Every demo prints it; a mismatch exits non-zero |