The non-custodial posture

Dynamo's contracts hold escrow that only the rules can move. This is the protocol's second law (after fail-closed), and it is structural — enforced by the sealed contract suite and its invariant tests, not by policy.

The four never-rules

  1. No admin key may withdraw user funds. There is no path — owner,

operator, upgrade, emergency — by which an administrator extracts escrowed value. The invariant suite attacks this directly.

  1. No admin key may redirect funds. Settlement pays the stream's service

node per signed vouchers; refunds pay the budget owner. No third destination exists.

  1. No admin key may freeze user funds outside the specified paths.

Revocation, halts, and holdback windows are rules the parties chose at open; there is no discretionary freeze.

  1. No stored-value balances exist beyond the escrowed budget itself. No

omnibus account, no internal wallet, no float. Close the budget and the remainder returns to the owner; there is nothing left behind to trust anyone with.

What this means per rail

RailCustody reality
ControlNothing to hold — no money exists
EscrowThe vault contract holds the deposit; movement requires signed vouchers (settlement), attested breakpoints (refund clips), or owner close (release). The contract, not the operator, enforces Σ child settlements ≤ deposit
CardThe card network holds the authorization; Dynamo instructs captures only up to voucher totals within the ceiling. Payees are paid by split transfer to their own connected accounts — funds do not pool in a Dynamo balance

Deliberate consequences

whose release paths are public; a card authorization expires by network rules if never captured.

model over session databases — it can export evidence, and it can move nothing.

contract code (sealed, invariant-tested) and the voucher cryptography (offline-verifiable) — not an operator's ledger.