How and WHEN are fees deducted in execution?

I've been trying to find out more about where and when exactly fees are deducted. ie) it seems that here in the process of sanitizing txs (post sigverify, dedup) that there is an initial fee deduction happening in check_fee_payer_unlocked specifically in a call to validate_fee_payer here:

    payer_account        .lamports()        .checked_sub(min_balance)        .and_then(|v| v.checked_sub(fee))        .ok_or_else(|| {            error_metrics.insufficient_funds += 1;            TransactionError::InsufficientFundsForFee        })?;

But in filter_program_errors_and_collect_fee in the bank it seems that fees are deducted in commit_transactions with the execution output?

But does that mean if a transaction uses LESS CUs than expected (calculated internally by the validator themselves), that the excess is NOT returned to users (unlike in ETH say for example where a failed tx's remaining gas limit is returned)

Also when CREATING the block, is CU requested used (ie. for the 12m / writable account limit) or would it be the CU used?