Usage Metering & Billing Pipeline · View 10 of 22 · Data
The test
- Only the top two zones answer no. The immutable record cannot be rebuilt because it is the record; the financial ledger cannot be rebuilt because an issued invoice is a published fact, not a derivation.
- Everything in the derived zone may be dropped and rebuilt by replay, which is why a corrupt aggregate, a bad deployment and an operator error all have the same remedy.
- Versioned configuration sits in its own zone because it is the one small, read-heavy store whose corruption is applied uniformly to every affected account at once.
Retention, as assumed
- Raw events queryable for 400 days, then cold for 7 years (stated assumptions) — the first covers a full annual cycle plus the 60-day dispute window, the second statutory audit.
- Event stream retained 24 hours: it is transport, and the ledger behind it is the durable copy.
- Entitlement cache has no recovery value by design; a cold cache costs latency, not correctness.
Risks
- Cold-tier retrieval cost and latency are a constraint on the dispute process, not a storage detail. A dispute outside 400 days is answerable but slow and chargeable.
- Object Lock on the audit tail means a retention mistake is not reversible. That is the point, and it needs to be a deliberate decision rather than a default.
