If the protocol breaks (is interrupted) after the server has signed and returned the refund transaction (T2) to the client, the server has to blacklist its input (the hash of T1) indefinitely, or am I overlooking something? Otherwise the client can replay T1 at a later time, after the locktime of T2 has passed, and refund to himself before the protocol is terminated. At least the server has to keep track of the timelock used in T2. What does the implementation do?
I don't understand you well but maybe this helps:
You
secretly ask the merchant for a refund of a
not yet published payment A.
The merchant
secretly sends you a contract B1 "If you publish A (aka send me $100) I send you B which can be used to send $100 to you."
Now with this contract in hands you
publish A.
Now you feel like you need some service from the merchant. You ask him and he offers you something for 10ct, but asks you to sign B2 "I $99.90 to you. This overrules B1"
As it's a fair deal, you sign it and send it to the merchant.
Now the merchant is compensated and grants you the 10ct. service.
Now you feel betrayed by the merchant and publish the very first full reimbursement but the merchant has time until the timeout of A expires to publish any lower reimbursement that you signed and that overrules all prior Bs.
The highest B at the end of timeout wins and becomes a blockchain transaction. This might happen before the timeout if B∞ gets published with all signatures early.