If we have a service interruption, there should be an easy way to credit installs for the downtime.
I roughly imagine just a table like:
<creditForInstancePHID, creditStartEpoch, creditEndEpoch, creditedByPHID, creditDescriptionEtc>
The `creditForInstancePHID` could be `null` to indicate that the credit applies to all instances (e.g., sitewide downtime) or non-`null` to indicate that credit applies to a specific instance.
When billing instances, we'd reduce the cost of each user by the fraction of billable time which was credited.