How it works

Three layers

1. Identity. A merchant name resolves to an address before the order exists. The address is then stored on chain. Settlement never re-reads a name, so a record changed afterwards cannot redirect an order that already exists.
2. Enforcement. The hook runs inside the swap. It refuses a partial fill and an output below the order's floor.
3. Receipt. The hook emits evidence; the executor emits the success signal only after measuring the merchant's own balance.

What the hook does, in order

1. Refuses any pool that is not the approved shape, where the pool is created.
2. Admits a swap only from the settlement executor, for an order being paid right now.
3. After the swap, refuses a partial fill or an output below the minimum.
4. Emits the receipt. That is evidence about the swap, not proof the merchant was paid.

The final check is the executor's: it measures the merchant's own balance after the swap and refuses to finish if it did not rise by at least the committed minimum.