Core guarantees
- balances cannot cross below zero;
- one idempotency key creates at most one logical operation;
- successful consume allocations sum exactly to the operation amount;
- denied operations have no allocations and no usage outbox event;
- every successful consume has one durable outbox row;
- paid payments and subscription periods materialize one deterministic source;
- exact rate arithmetic is enforced in Rails, Go, and PostgreSQL.
Billing-event publication
Usage publication is at-least-once. The credit operation ID becomes the billing transaction ID, so retrying after a timeout cannot create a second usage effect. Workers claim rows in bounded waves and reconcile published events against committed operations. A failed delivery to billing is retried for about a day before the event is dead-lettered. A dead-lettered event does not block credit usage:503 credit_usage_publication_backlog is returned only while 1,000 or more events are still being retried, or the oldest is older than 5 minutes, and clears by itself. Dead-lettered events wait for Nozle support to requeue them.
Reconciliation
Continuous jobs detect:- source remaining amount that disagrees with immutable allocations;
- successful consumes missing allocations or an outbox row;
- denied consumes with side effects;
- missing billing events;
- missing subscription grants;
- paid top-up invoices without a credit source.