HTLCs lock funds with a hash. Alice pays Bob via Carol. Alice creates preimage R, locks 1000 sats to H=sha256(R). Bob sees H, locks 990 sats to Carol. Carol reveals R to unlock. Bob gets R, reveals to...
The last hop runs the other way: Carol locks the 990 sats to Bob. Bob claims them by revealing R, and Carol learns R only from that claim, then uses it to take the 1000 from Alice. If Carol stalls, each HTLC expires back to whoever funded it, so Bob never holds Alice's sats and has nothing to refund.