Engineering · Metering
How we count: exactly-once metering at the edge
Double-billing a customer once costs more trust than a year of accurate invoices earns. Here is the architecture that keeps our counters honest.
Ravi Chandrasekhar, Principal Engineer · June 2026 · 9 min read
Every metering system eventually faces the same interview question from reality: a customer’s worker crashes mid-request, their framework retries, and your ingest endpoint receives the same event twice. If you count it twice, you have built a machine for manufacturing billing disputes. If you drop both, you have built one for leaking revenue. Exactly-once is not a luxury in billing — it is the product.
Quanta enforces idempotency at the edge, not in the database. Each event carries a client-supplied idempotency key, and every one of our 41 ingest regions holds a sliding window of recently seen keys in memory, backed by a replicated log. A duplicate arriving anywhere inside the window is acknowledged with the original result — same status, same event id — so client retry loops terminate cleanly without ever reaching the pricing engine.
The window is the interesting trade-off. Too short and a slow retry slips through as a fresh event; too long and memory grows without bound. We hold keys for 72 hours — three orders of magnitude past the 99.9th percentile retry gap we observe in production — and after the window closes, a nightly reconciliation job replays the raw log and flags any duplicate that somehow survived. In four years of operation the reconciler has fired exactly three times, all during one regional failover in 2024, and all three were corrected before invoicing.
duplicate suppression inside the 72h window
fig. 1
Counting is only half the contract; the other half is being able to prove the count. Every priced line item on a Quanta invoice carries a cursor into the immutable event log that produced it. When a customer disputes a number, support does not investigate — they paste a link. The dispute usually ends there, because the disagreement was never about the math; it was about whether the math could be seen.
The lesson we keep relearning: billing infrastructure is trust infrastructure. The architecture above is not exotic — idempotency windows, replicated logs, reconciliation sweeps are standard distributed-systems furniture. What makes it billing-grade is the refusal to let any component be unauditable. If a number cannot be traced to its events, it does not go on an invoice.
“If a number cannot be traced to its events, it does not go on an invoice.”