# Why the numbers are right

The only thing a metrics product sells is trust in the numbers. Here is
what that means mechanically.

## A `202` is a promise

Acceptance means your event is in a durable queue, not in some server's
memory. If our analytics store is down, events buffer and retry; if
retries exhaust, the batch is parked in a dead-letter store and replayed,
never dropped. And ingest never returns `5xx` for load: your signup flow
cannot be broken by our capacity.

The promise cuts the other way too. If the durable queue itself refuses a
write, we return `503` rather than `202`, because a `202` we cannot honour is
worse than an error you can retry, and the SDKs retry it for you. `202`
means stored, always.

## Duplicates cannot move behavioral metrics

MAU, DAU, and signups are **distinct counts over users**, computed with
HyperLogLog sketches. Insert the same `user_signup` twice, or fifty
times, and the distinct count of users does not change. Dedup isn't a
best-effort filter we hope catches things; the math is immune.

## Money is deduped by construction

`payment` events require an idempotency `id` and land in a storage engine
whose primary key **is** `(project, id)`. A replayed webhook, a client
retry, an at-least-once queue: all collapse to one row. Revenue queries
read through that dedup. There is no code path where the same payment
counts twice.

## MRR reads the latest state, always

Subscriptions are versioned upserts. An upgrade from $49 to $99 exists as
two versions; MRR reads the newest version of each subscription and sums
the active ones. Racing updates, replayed updates, out-of-order
deliveries: the latest version wins, once.

## Client clocks are handled, not trusted

Offline clients send *their* view of when things happened plus when they
flushed; the server cancels the clock skew between them. Claims are
clamped to a 7-day window so a device with a 1970 clock (or a hostile
client) can't write garbage history. The raw claim is preserved for audit.

## We watch ourselves

The pipeline counts what it accepts and what it delivers, through
DataGauge itself, and alerts on any divergence. A metrics product must
never learn about its own data loss from a customer.