Separating information leakage from price integrity is useful. I would make the quote reference carry an explicit pricing-version and expiry policy too: if the rules change between preview and acceptance, silently recomputing can surprise the buyer even when the server is authoritative. A clear “quote expired, review the new total” step keeps the security boundary and the buying experience aligned.