If we have a service interruption, there should be an easy way to credit installs for the downtime.

I roughly imagine just a table like:

<creditForInstancePHID, creditStartEpoch, creditEndEpoch, creditedByPHID, creditDescriptionEtc>

The creditForInstancePHID could be null to indicate that the credit applies to all instances (e.g., sitewide downtime) or non-null to indicate that credit applies to a specific instance.

When billing instances, we'd reduce the cost of each user by the fraction of billable time which was credited.