Security

No owner, no pause, no proxy

Every chain-dependent parameter is fixed at construction and can never be written again. There is no owner, no pauser and no upgrade path. That is deliberate, and it has a cost worth stating: if a defect is found there is no recall. The only response is to stop directing payments to that deployment.

Scoped identity permission

A delegated agent is modelled to hold one text-record permission and no address permission. No agent currently holds a live role, and settlement does not depend on any record: the recipient is fixed before the order exists.

Permission state is read from chain when script runs. Unread authority is not absent authority.