Brand comes from the host, never from the browser
The correctness question in any multi-tenant storefront is: where does the tenant come from? If it is anything the browser can send — a form field, a query parameter, a stored preference — then an order can be recorded against the wrong brand, and eventually one will be. We resolve it from the request hostname and pass it to the order routine directly, so the client is never asked and cannot answer incorrectly. Order numbering derives from the same source, which makes the order number itself evidence of which brand took the sale. Preview hosts are the one place an override is permitted, and real domains ignore it entirely.
