Usage Metering & Billing Pipeline  ·  View 15 of 22  ·  Runtime

Restatement and Evidence

The correction path: how a wrong figure is put right without a single mutation.

Editable source SVG draw.io All views
Trigger Anomaly gate Customer dispute Scope Restatement API account, meter, period Scope bounded? Unbounded refused Replay Read event range Athena over Iceberg Re-meter same code path Re-rate plan version as-of Compare Difference report Original retained never overwritten Remedy Two-person authorisation Credit memo Superseding invoice Record Restated figure both versions kept Audit record reason + identity Customer notice with evidence export refused provenance answered Restatement and Evidence — Correcting Without Editing Decision point Person or role Interface / broker Risk / gap Application we own Data store Security / platform failure / alternate batch synchronous Nothing on this path mutates an issued figure. The remedy is a new record, and the original survives so the history of a dispute is itself auditable. v 1.0 · owner Architecture Practice · date 2026-10

Decisions

  • Nothing on this path mutates an issued figure. The remedy is a new record and the original survives, so the history of a dispute is itself auditable.
  • A restatement whose scope is unbounded is refused by the platform, not discouraged by process. Scope is account, meter and period, and the guard is on the diagram because it is a control.
  • Re-metering uses the same code path as the original, so the restated figure is a correction rather than a second opinion.
  • The audit record is written before the action runs, so an action that fails is still on the record.

Assumptions

  • A single account's 90 days replays through metering and rating within 30 minutes (stated assumption) — the figure that decides whether a dispute is handled inside a working day.
  • Dispute window of 60 days from issue (stated assumption), which is what the 400-day queryable retention is sized around.

Risks

  • The remedy choice is a policy decision the architecture deliberately does not make: credit memo or superseding invoice is question 6 of the requirement, and it is unresolved.
  • Replay determinism is an assumption until it is tested. A non-deterministic aggregate — an unordered distinct count, a floating-point sum — would make every restatement arguable, which is why replay determinism is a watched signal in view 18.
◀  Meter Types All views Deployment Architecture  ▶
Solution Architecture v1.0 · Amazon Web Services · Billing Platform Architecture · 2026-1015-restatement-and-evidence