Invoices frozen at issue and coupons that pay out only once

Every system that issues documents eventually has to decide what an old document shows after its template changes, and most decide too late.

Templates change: a layout is corrected, a legal notice updated or a logo replaced. Then someone opens a document issued two years ago and sees this year's template, with this year's legal text, on a record that was signed under different terms.

No error is raised when a template change alters an old document, and from that point the archive no longer shows what was actually issued.

Creation and validity can drift apart in other systems too: a coupon printed with no network, or a whiteboard that only exists as a screenshot.

Customs invoicing (2020). The customs authority required that an issued invoice never change. So at the moment of issue, the document was rendered and stored as immutable HTML, and later template edits touched nothing already issued.

The system kept the definition of a document separate from the issued document, so the template could keep evolving while the history stayed intact. The frozen output also no longer depended on the rendering code staying correct in the future. Had documents been rendered on demand, any change to that code would have retroactively altered every old document.

Remittance terminals (2022). A recipient collected cash at a filling station using a coupon code. The terminal had to keep working when the network was down, but a coupon that paid out twice was the one failure that cost real money.

The terminal printed each coupon as not yet valid, because a coupon that could not be used yet was an acceptable price for never paying one out twice. A coupon became valid when the system said so: automatically when the connection came back, or manually through an operator, who was alerted that an unactivated coupon existed. The system knew which coupons had been printed and were not yet valid, so none of them could be lost without anyone noticing.

Meeting platform (2023). The whiteboard was saved as structured objects instead of a flat image, so every stroke, shape and piece of text kept its own properties. After the meeting, people could reload the board and keep editing it.

In all three products the record stayed intact through the event that usually breaks it: a template change, a lost connection or the end of a session.

• Customs invoicing: validated on 50,000 invoices, none of which changed after issue

On the customs system, freezing the issued document was correct but incomplete, because the template itself was never versioned. No issued invoice could change, but there was no record of which template version produced it, or of who changed the template and when. The snapshot answered the urgent question and left the audit question open. I would version the templates from the start and point each issued document at the version that produced it.