The manifest is written before the first provider call and records the plan, the policy and pool versions in force, the candidates refused and why, every attempt including fallbacks, and what was actually billed.
Most gateways record what ran. Planverity records what was refused and the constraint each candidate failed, separating a hard-policy exclusion from a quality-threshold miss. One is governance and one is tuning; conflating them leads operators to relax a policy when they only needed to lower a threshold.
Predicted cost and billed cost appear side by side and labelled. An unmeasured quality score reads 'not yet measured', never zero. A savings baseline with no feasible alternative reads 'no alternative existed', never $0 — a zero would claim the alternative was free.
A database trigger rejects updates and deletes on settled usage. Corrections are adjustment rows, not edits, so a cost figure cannot be quietly revised after the fact.
There is no grader on live traffic, so verified quality is not computable. The console states plan-compliance — that the selected route's lower-confidence bound cleared the floor at planning time — and refuses to present it as measured quality.