The only thing a metrics product sells is trust in the numbers. Here is what that means mechanically.
A 202 is a promise
Acceptance means your event is in a durable queue, not in some server's
memory. If our analytics store is down, events buffer and retry; if
retries exhaust, the batch is parked in a dead-letter store and replayed,
never dropped. And ingest never returns 5xx for load: your signup flow
cannot be broken by our capacity.
The promise cuts the other way too. If the durable queue itself refuses a
write, we return 503 rather than 202, because a 202 we cannot honour is
worse than an error you can retry, and the SDKs retry it for you. 202
means stored, always.
Duplicates cannot move behavioral metrics
MAU, DAU, and signups are distinct counts over users, computed with
HyperLogLog sketches. Insert the same user_signup twice, or fifty
times, and the distinct count of users does not change. Dedup isn't a
best-effort filter we hope catches things; the math is immune.
Money is deduped by construction
payment events require an idempotency id and land in a storage engine
whose primary key is (project, id). A replayed webhook, a client
retry, an at-least-once queue: all collapse to one row. Revenue queries
read through that dedup. There is no code path where the same payment
counts twice.
MRR reads the latest state, always
Subscriptions are versioned upserts. An upgrade from $49 to $99 exists as two versions; MRR reads the newest version of each subscription and sums the active ones. Racing updates, replayed updates, out-of-order deliveries: the latest version wins, once.
Client clocks are handled, not trusted
Offline clients send their view of when things happened plus when they flushed; the server cancels the clock skew between them. Claims are clamped to a 7-day window so a device with a 1970 clock (or a hostile client) can't write garbage history. The raw claim is preserved for audit.
We watch ourselves
The pipeline counts what it accepts and what it delivers, through DataGauge itself, and alerts on any divergence. A metrics product must never learn about its own data loss from a customer.