Verification snapshots lock the offer to pay

What the public implementation shows

The domain contains BillVerificationSnapshot and the gateway returns amountLocked and creditorLocked fields with normalized bill-payment details.

The snapshot connects the pre-payment verification response to later confirmation against the durable bill. This is the implementation fact behind the note; the architectural reading begins from that visible boundary rather than from an assumed production story.

Operating principleVerification is meaningful only when payment can prove what was verified.

The decision behind the mechanism

Recording verified terms makes amount, currency, and creditor comparison an explicit control instead of relying on mutable current state.

A bill or routing configuration can change after the payer approves the displayed terms but before confirmation arrives. The mechanism matters because it gives that failure a named boundary, durable evidence, and a controlled response instead of leaving the outcome to timing or operator guesswork.

• Snapshot the amount, currency, and creditor identity.
• Bind the snapshot to the verification transaction.
• Compare confirmation against both bill and snapshot.
• Expire or invalidate snapshots under a clear policy.

How the control should be operated

Snapshots should retain bill identity, financial terms, verification identity, time, and the request context needed to explain a later mismatch.

Confirmation can reject changed terms and show which verified fact no longer matches. The reusable lesson is not to copy a class or endpoint in isolation, but to preserve the relationship between identity, state, authority, evidence, and operational ownership.