At-least-once transport with an idempotent upsert keyed on request_id. Exactly-once delivery is not attempted; exactly-once effect is achieved at the sink, which is cheaper and easier to prove.
Billing reads the ledger, never the stream. A Kafka replay after an incident corrects the ledger and cannot double-charge a tenant.
The budget enforcer is a feedback loop back into L2 counters, closing the path from cost to admission (FR9, and the cost constraint in the problem statement).
Numbers
24 partitions on usage.v1, keyed by org_id, sized for 1M events/s at the design ceiling with headroom for rebalancing.
Kafka retention 7 days — the replay window for ledger reconstruction.
End-to-end lag target under 5 minutes from completion to a queryable ledger row; budget counters refresh on a 60 s cycle.
Risks
Where a provider omits token counts on a streamed response, the row is marked estimated. Estimated rows are excluded from invoices and reported separately; the current share is under 2% of traffic.
Flink checkpoint failures stall aggregation without stalling ingest. The alert is on consumer lag, not on Flink health, because lag is what actually harms the tenant.
