Atomic execution
All hops settle in one 100ms block or none do.
The winning route is executed as a single bundle within one block. Either every hop's nullifier is revealed and every output note created, or the entire bundle reverts with no state written. Because there is no partial execution, there is no public intermediate state to observe and no window in which a third party can insert a transaction between hops.
Sequence
(1) The solver submits the bundle with the aggregate proof. (2) The sequencer verifies the proof and anchor. (3) Nullifiers are checked against the set. (4) Pool state transitions are applied. (5) Output notes are appended to the tree. Observers learn that a valid shielded settlement occurred and the net pool deltas; they do not learn sender, recipient, or hop structure.