Three questions every settlement system must answer honestly: when is a payment final, who gets made whole when work fails, and who eats the fee on refunded money. Dynamo's answers are mechanical.
A settlement becomes final when its holdback window closes — a per-stream dial (default 300 seconds, or the SLA window where SLA terms exist; provider-accepted range 0–86,400 seconds; zero is legal). Until then the settled funds are reachable: refundable by rule, without anyone's cooperation. After finality, funds are the payee's — the protocol never claws back a final settlement.
Checkpoint cadence tunes the same trade-off from the other side: sparse checkpoints keep a larger unsettled buffer (payer-protective), frequent checkpoints finalize faster (payee-protective). Both sides know the dial settings at open; nothing is renegotiated mid-stream.
When an attested SLA break-point (or revocation with degraded units) creates a refund obligation:
envelope and any settlements still inside their holdback window. The refund executes fail-closed against reachable funds; it does not depend on the payee's goodwill or solvency.
Recourse moves to the payee's published terms, armed with the evidence export — the protocol does not pretend to a power it deliberately does not have.
No Dynamo fee is earned before its units are final. When units are refunded:
never earned.
settled balance first, then as a negative-balance obligation against future settlements.
fee** — Dynamo's own revenue loss, capped by construction, never a booked loss and never socialized onto the buyer.
Every fee is its own explicit ledger row tied to the settlement that produced it — accrual, reversal, and netting are each visible, auditable entries, never implicit adjustments. The session view carries them all.
The refund machinery is the last line, not the first: refused ticks, failed deliveries, and cancelled reservations are never billed at all. No cost is incurred, paid, or passed through for failed actions — the refund path exists for work that was paid for and then attested degraded, not as a substitute for failing closed up front.
Run the whole ladder — SLA terms → attested degradation → throttle → halt → break-point → buyer-whole-first refund → fee reversal + netting → final reconciled ledger — with make demo-sla, on every backend.