Skip to main content
PostgreSQL balance sources plus immutable allocations are the credit source of truth. Redis is never authoritative for consumption.

​
Core guarantees

  • balances cannot cross below zero;
  • one idempotency key creates at most one logical operation;
  • successful consume allocations sum exactly to the operation amount;
  • denied operations have no allocations and no usage outbox event;
  • every successful consume has one durable outbox row;
  • paid payments and subscription periods materialize one deterministic source;
  • exact rate arithmetic is enforced in Rails, Go, and PostgreSQL.

​
Billing-event publication

Usage publication is at-least-once. The credit operation ID becomes the billing transaction ID, so retrying after a timeout cannot create a second usage effect. Workers claim rows in bounded waves and reconcile published events against committed operations.

​
Reconciliation

Continuous jobs detect:
  • source remaining amount that disagrees with immutable allocations;
  • successful consumes missing allocations or an outbox row;
  • denied consumes with side effects;
  • missing billing events;
  • missing subscription grants;
  • successful top-up payments without a credit source.
Repairs use idempotent materialization or explicit compensating operations. They never rewrite historical ledger rows.

​
Acceptance audit

Use Nozle’s read-only credit audit tooling to check source balances against allocations, operation totals, rate arithmetic, delivery envelopes, tenant ownership, publication, and reconciliation. It exits nonzero on drift and never repairs data. Run it after the canary settle window and retain the JSON report. See Credit Rollout and Acceptance.