do not store merkle root before verification succeeded. keep it in requested_merkle for the session