Make it impossible to do the wrong thing

A field note on converging a mesh of small services onto one durable quota ledger — and why the goal was never "add a feature" but "delete the ways to get it wrong."