Metered infrastructure bills time, not value — and in a failure, time can run to infinity. On Nov 8, 2026, a CallPages test call to our own number stayed connected 14,400 seconds with nobody talking and cost $0.96 — 74.8% of our all-time voice spend — because our system never hung up and our monitoring never noticed.
Every metered infrastructure bill — voice minutes, video minutes, tokens, serverless time — is priced as rate multiplied by duration. The rate is in the contract, where you can negotiate it. The duration is decided by your worst failure mode, in production, at 3 AM, and it has no natural ceiling: a connection that never closes bills until somebody notices. Most teams govern the rate obsessively and the duration not at all. We know, because we audited our own carrier bill down to the last leg and found a four-hour call with nobody on it — placed by our own system, to our own number, ended by hand, and discovered by a human reading the bill, not by any monitor we owned.
The runaway, replayed fast: four hours of connection, zero seconds of conversation. The meter does not care which one it is timing.
The hook: a call with nobody on it
On Sunday, November 8, 2026, at 11:36 in the morning, our platform placed a test call to our own phone number. The call connected. And then — nothing. No voice on either side, no media, no conversation. Just an open line, and a meter running on it.
It stayed connected for 14,396 seconds. Billed, with the rounding carriers apply, as exactly four hours.
Nobody at CallPages noticed. Not our dashboards, not our alerts, not our error tracking. The line was eventually ended by hand, hours later, in the course of other work. The charge itself was found the next morning by the most old-fashioned monitoring system in the world: our founder read the bill, saw a number that made no sense, and asked why.
We build AI voice agents. Our pages place and receive real calls for real businesses, and our CRM places outbound calls from a customer's own record, in their own business's voice. Voice is our product, so voice is also our plumbing: like every company in this space, we buy telephony by the minute from a carrier — ours is Telnyx — and minutes are the purest form of metered infrastructure there is. Cheap, honest, and utterly indifferent to whether anything useful is happening on the line.
This essay is the full story of that call: what our audit found when we pulled every single leg we have ever been billed for, why the failure happened, the arithmetic that makes a stuck call a bankruptcy-shaped risk at any real scale, why smart teams walk straight past this class of bug, and the system of checks and balances we built so that no call of ours can ever quietly run to infinity again. We are publishing our own numbers, including the embarrassing ones, because the failure mode is not ours alone. It belongs to everyone who buys infrastructure by the minute, the token, or the second — which is now everyone.
One thing before the numbers, because it matters: Telnyx billed this call correctly. Every cent in this story reconciles exactly against the contracted rate, as you will see below. This is not a story about a carrier overcharging. It is a story about a meter doing exactly what meters do, and about everything that has to be true on your side of the meter for that to be safe.
1. The census: we audited every leg we have ever been billed for
The morning after, we did not sample. We pulled the account's entire call-control billing history, leg by leg, from the first day the account existed, and reconciled each leg against the rate and against our own call records. Here is the whole truth of our voice spend, October 21 to November 9, 2026:
- 97 billed legs. 642 billed minutes. $1.284, total, all-time.
- October 21–31: $0.112. November 1–9: $1.172.
- Exactly one expensive day exists in our history: November 8, at $1.092 — 85% of everything we have ever spent on voice. Every other day, all twenty of them, cost $0.030 or less.
- The median billed leg is 60 seconds — the per-leg minimum. Sixty-six of ninety-seven legs bill exactly that.
- Every single leg reconciles to the cent: cost equals billed minutes times $0.002, with per-started-minute rounding and a 60-second minimum per leg. Zero carrier errors. Zero duplicate charges. And the eight legs that never connected — busy, no answer — were billed $0.00, every one.
Our entire voice bill, day by day. Nineteen quiet days — and one Sunday that cost more than all of them combined, several times over.
Inside that one Sunday sits the whole lesson, in three layers:
The runaway. One call, two billed legs, 14,400 billed seconds each, $0.48 per leg — $0.96, which is 74.8% of our all-time voice spend, on a single call with zero conversation. Two legs out of ninety-seven. That is the distribution of metered waste: not a long tail of small leaks, but a single catastrophic shape sitting on top of an otherwise healthy account.
The dead air. The same day, three more of our test calls connected and produced pure silence, because the media path on our side never started: one burned 571 connected seconds before our team killed it through the API ($0.040 for the pair of legs), one 390 seconds ($0.028), one 87 seconds ($0.008). All ours, all pre-fix, all billed correctly. For contrast, the longest real conversation that day — a genuine 625-second working call — cost $0.044. Read those two numbers side by side: ten minutes of dead air, $0.040. Ten minutes of actual conversation, $0.044. The meter cannot tell the difference. Only you can.
The unmatched. Two connected inbound legs — one on November 1 (330 seconds, $0.012), one on October 26 (273 seconds, $0.010) — had no matching call record in our system at all. Not mislabeled: absent. We cannot tell you whether a conversation happened on them, because our side kept no record. They predate our current record-keeping, and we flag them here the way we flagged them to the carrier: as a detail request, not a dispute — you cannot honestly contest a charge you cannot reconstruct. A bill you cannot reconcile against your own records is a bill you are paying on faith.
Every leg we have ever been billed for, by duration. The median leg is one minute. The two on the right are 74.8% of all the money.
We reported the runaway to Telnyx the next morning, in writing, with the full carrier record IDs, in exactly the terms it deserved: the failure to terminate the leg was ours; the rate was applied correctly; we requested a courtesy adjustment of $0.96 and asked whether the platform offers a maximum-duration safeguard we should enable as a backstop. That is the only honest posture when the meter was right — and, as the blueprint in section 5 covers, the dispute discipline matters because carrier terms give you a short window (in Telnyx's case, billing disputes in writing within 15 days of the invoice date) to raise any of it at all.
2. Anatomy of a runaway: how a call learns to never end
A stuck call is not one failure. It is three failures wearing a trench coat, and each layer is a place your own system can quietly hand the meter an infinity to bill.
Layer one: the connection succeeds. This is the part nobody suspects. The carrier's meter does not run on attempts — our eight never-connected legs cost exactly $0.00 — it runs on connection. Every dangerous shape in metered infrastructure shares this property: the failure happens after the resource is successfully allocated and billing has legitimately started. A runaway is not a failed call. It is a successful call whose ending failed.
Layer two: the ending depends on the thing that broke. Our stack ended calls the way most event-driven systems do: when the call's event stream said the call was over, cleanup ran — hangup sent, record finalized, meter stopped. That day, a defect in our call-event handling meant the events stopped being processed correctly on our side. No events, no cleanup. No cleanup, no hangup. The system was not down; from the inside, it looked quiet — and in an event-driven architecture, the absence of events is indistinguishable from peace. The cap that depends on the call's own events is precisely the cap that fails when the call does. Whatever terminates a resource must live outside the resource's own failure domain. Ours didn't. It does now.
Layer three: the call was to ourselves, so it billed twice. The destination was our own number, and a call to your own carrier number is really two calls from the meter's point of view: an outbound leg leaving your connection, and an inbound leg arriving at your number. Both legs connected. Both legs ran four hours. Both legs billed $0.48. This is worth internalizing far beyond telephony: self-referential traffic multiplies. Test calls to your own numbers, services calling their own APIs, agents delegating to themselves, retry loops that re-enter your own stack — each pass through the meter is a fresh charge, and a loop multiplies the runaway by its own structure. Our four hours cost double not because anyone erred twice, but because the topology charged twice for one bug.
Add the dead-air calls and the pattern completes: in every case the meter was honest, the connection was real, and the value was zero. The gap between "connected" and "useful" is where metered money goes to die — and no carrier dashboard will ever show it to you, because from the carrier's side of the glass, a four-hour silence and a four-hour conversation are the same product, delivered perfectly.
3. The math of infinity
Our runaway cost $0.96. It is tempting to laugh at that number — we did, briefly — and the laugh is exactly the trap. The $0.96 is not the cost of the bug. It is the cost of the bug at our current scale, at the cheapest rate we buy, discovered within a day. Per-minute pricing times unbounded duration is an uncapped liability whose final size is set by three variables: the rate, the number of stuck resources, and the time until a human notices. Your budget controls none of them. Run the same stuck leg at other honest rate points and timeframes:
- At our rate, $0.002/min: $0.12 an hour, $2.88 a day, $20.16 a week, $86.40 a month — per stuck leg.
- At $0.01/min (ordinary business voice in many markets): $14.40 a day, $432 a month.
- At $0.05/min (international and mobile routes get here fast): $72 a day, $2,160 a month.
- At $0.25/min (premium mobile routes — real routes, in our own rate research, cost this): $15 an hour, $360 a day, $2,520 a week, $10,800 a month. For one stuck call.
The math of infinity: one stuck leg, left alone for a month. The only variable your bug controls is how long it takes you to notice.
Now scale the other two variables. A bug rarely sticks one line; it sticks a class of calls. Ten stuck legs at $0.05 is $21,600 a month. A hundred at that rate is $216,000. And time-to-notice is brutally nonlinear in practice, because notices cluster on business days: a failure that starts Friday at 6 PM and is found Monday at 9 AM has already run 63 hours — $945 at the premium rate, for a single leg, over one weekend nobody was watching. Our own runaway, at a premium-route rate instead of our cheapest one, would have been $120 for the same four hours — and $1,890 if it had started Friday evening instead of Sunday morning.
The same shape repeats across every metered API you buy, because the shape is not telephony. It is price times time times a failure that holds the resource open. A video API bills participant-minutes the same way. An LLM agent in a retry loop bills tokens the same way — the loop is the stuck call, and the context window is the line that never hangs up. Serverless bills duration. Egress bills whatever your misconfigured sync job decides to move, forever. In each case the contract told you the rate proudly, in large print, and said nothing about the duration, because the duration is yours — your bug, your loop, your missing watchdog. Metered pricing converts your worst reliability failure directly into your largest variable cost, at a conversion rate set by the vendor's price list. That is the danger the headline price never mentions: $0.002 a minute sounds like nothing, and it is nothing — right up until it is multiplied by infinity.
4. Why smart teams miss it
We are not careless people. We reconcile, we test, we ship with gates. And this still walked past every defense we had, because the defenses were each aimed at a different shape of problem. If your stack resembles ours — and most do — these are the four blind spots to check tonight:
Your dashboards show totals, not shapes. On every aggregate we owned, November looked fine: a dollar and change of voice spend for the month is not a chart that makes anyone sit up. The catastrophe was invisible in every total and obvious in exactly one view — the duration distribution of individual legs — which nobody had built, because nobody thinks of a phone bill as a distribution. Waste in metered systems is a shape: one leg at 240 times the median. Totals average it into invisibility.
Your spend alerts are thresholds on aggregates, and aggregates lag. An alert that fires when monthly spend crosses $X fires after the money is gone, and only if X is small enough to matter at your scale — at a bigger company, our entire incident is a rounding error under every threshold, which is precisely how six-figure versions of this bug survive for quarters. The signal that would have caught ours in the first hour costs nothing: no single leg may exceed N minutes. Shape alerts, not spend alerts.
Your tests simulate success, and the stuck call is a failure of ending. Every test we had placed calls, connected calls, completed calls. None simulated the call that never completes — no hangup event, no final state, a record stuck open while the world moves on. Endings are code paths too, and they are the ones carrying the money. If you take one practice from this essay: add the stuck-resource case to your test suite — the call that connects and then hears nothing, forever — and assert something in your system notices.
The bill arrives monthly; the bug runs in real time, and the dispute window is short. Telephony invoices land weeks after the minutes burn, and the terms give you fifteen days from the invoice to dispute in writing. A team that reconciles monthly is structurally guaranteed to discover some waste after its right to contest it has expired. We found our runaway in a day because a human happened to look. "A human happened to look" is not a control. It is luck with a person's name on it.
5. The checks-and-balances blueprint
Here is the system we built in response — described as transferable principles, because none of it is telephony-specific. Where we stand on each piece is stated plainly: the hangup defect itself was fixed the same day; the recovery sweep that finds and finalizes stuck records shipped in the next morning's release; the anomaly watch and the weekly billing digest are live; the watchdog cap, silence termination, reconciliation engine and quality grading are landing in the current cycle. All of it exists because of one Sunday.
1. Cap the duration, independently. Every call gets a hard maximum — ours is 30 minutes — enforced by a watchdog that does not consume the call's own events. The watchdog sweeps live calls on its own clock and kills any leg past the cap at the carrier, then finalizes the record with the end cause written down. Independence is the entire point: a guard that reads the same event stream whose failure it guards against is a decoration. In your stack the equivalent is a reaper that runs outside the worker it reaps.
2. Terminate on silence and on emptiness. A connected call with no voice is not a call; it is an open meter. Ours now die young: twenty seconds of silence is the ceiling, a warning fits inside that budget, and a call that connects to zero speech dies by the same rule. The general principle: define the value signal of the metered resource (voice, tokens of substance, bytes that change state) and cut the resource when the value signal flatlines — do not wait for the duration cap to save you from a call that was worthless in its first minute.
3. Reconcile the vendor's records against yours, continuously. Every carrier leg must match exactly one of our call records, joined on the carrier's own IDs, with the carrier's billed duration and cost written onto our record. A leg that matches nothing is not silently dropped: it becomes a flagged shadow in our own activity feed, labeled NOT MATCHED, cost visible, never counted in our billing totals. Discrepancies are recorded as notes, never overwritten. The two record-less legs from our census are exactly what this catches — you cannot fix a records gap you refuse to display.
4. Watch shapes hourly; digest weekly; dispute automatically. An hourly watch scans for the shapes of waste — legs past the cap (which we classify as a rule failure, the highest severity we have), single legs above a cost line, connected legs with empty transcripts, unmatched legs, unexplained balance deltas — and when it finds wasted money it files the courtesy dispute itself, once, from a ledger so it can never double-file. A weekly digest keeps the slow picture in front of a human: balance, week and month spend, bad-quality dollars as a share of spend, unmatched count. Automation catches the hour; the digest catches the drift.
5. Grade the quality of every metered unit. Each outbound call now gets a quality record: was there voice on our side, voice on the customer's side, a real exchange, a usable transcript? Dead air stops being an anecdote and becomes a metric with a denominator — and, eventually, a billing rule: a call that obviously never became a conversation is not a call we charge our own customers for. Whatever you meter, measure whether the metered unit did anything. If you cannot grade it, you cannot govern it.
6. Make the vendor's clock your clock. Keep the dispute window on a calendar, not in a terms-of-service PDF. Know when the invoice lands, when the window closes, and reconcile on a cadence that leaves the window usable. Fifteen days is generous if your reconciliation runs daily and punitive if it runs monthly.
None of this required new vendors or new spend. It required admitting that the meter is an adversary-shaped surface: not malicious, just perfectly indifferent, running at machine speed against human attention. Checks and balances are how you make attention machine-speed too.
6. What we would ask any infrastructure vendor
We stayed with our carrier — the meter was honest, and honesty is the main thing a meter owes you. But this incident rewrote the questions we will ask every metered vendor from now on, and we offer them as a buyer's checklist:
- What is the maximum lifetime of a single billable unit, and can I set it? If a leg, a session, a stream can live forever by default, the default is the risk. (We asked our carrier exactly this about a per-connection maximum-duration safeguard, in the same email as the refund request.)
- Where is my spend circuit breaker? Not an alert — a breaker: a per-hour or per-day ceiling that stops allocation, the way a fuse stops current. Alerts notify humans; breakers protect weekends.
- How fast do I see records? A real-time or near-real-time record stream makes reconciliation a control. A monthly CSV makes it an archaeology project, conducted after the dispute window closes.
- What anomalies do you flag for me? The vendor sees the shape of waste across every account it serves. A carrier that can see a four-hour zero-media leg and say nothing has telemetry it is not sharing; ask what they surface, and grade the answer.
- What is the dispute window, in days, from what date? Get it in the evaluation doc, not after the first bad invoice.
A vendor with good answers is selling you governed time. A vendor with none is selling you raw infinity, and the governance is — as we learned — entirely your problem.
7. The honest ending
The most uncomfortable line in our audit is not the $0.96. It is this one: unambiguously carrier-caused charges in our entire history: $0.000. Every abnormal dollar was ours — our defect, our dead air, our missing records. That is also the good news, and the reason we are publishing this instead of quietly fixing it. A risk that is entirely on your side of the meter is entirely within your power to govern: cap it independently, kill it on silence, reconcile it continuously, grade it, and mind the window. The teams that get bankrupted by metered infrastructure are not the ones with the worst bugs. They are the ones whose bugs ran longest before a system — not a person who happened to glance at a bill — noticed.
We build CallPages so small businesses can trust an AI agent with their customers' calls — the agent that calls from the CRM, knows the customer's record, and writes everything back. Trust like that is earned in the plumbing: in whether your platform can prove, leg by leg, what every minute bought. Ours now can. If you are building on metered infrastructure — voice, video, tokens, anything priced by the clock — we hope our Sunday saves you yours.
If you want the agent without the plumbing worries, get your free CallPage — and if you want to argue about watchdogs, we read every reply.
All figures in this post come from our own production billing audit of November 9, 2026: 97 carrier legs, each reconciled against the contracted rate and, where a record exists, against our own call records. The two legs without a matching record are described as such. Related reading: The robot that said no — what our agent taught us about governing the other side of the system; Mission Control for your calls — the live-call surface this plumbing feeds; and Call records you can trust — the record standard the reconciliation engine enforces.
How it works
- Cap the duration, not just the spend: every call on our platform now carries a hard 30-minute maximum — and a legitimate call that needs longer is a product decision, not an accident.
- Enforce the cap with an independent watchdog: a sweeper that does not listen to the call's own event stream watches every live call and kills the carrier leg itself when the cap hits. The cap that depends on the thing it caps is the one that fails.
- Terminate on silence: a connected call with no voice on either side ends in seconds, not hours — twenty seconds of silence is our ceiling, and a call that connects to nothing dies by the same rule.
- Reconcile the bill against your own records, continuously: every carrier leg must match one of our call records, with both IDs on the same record. A leg that matches nothing appears in our activity feed labeled NOT MATCHED — visible, cost attached, never hidden.
- Watch for shapes, not totals: an hourly anomaly watch looks for the shapes of waste — legs over the cap, single legs over a cost line, connected legs with empty conversations, unmatched legs, unexplained balance movement — and files the dispute itself when it finds one.
- Grade every call's quality: voice on our side, voice on the customer's side, a real exchange or dead air. A metered thing that produced no value should be measurable as such, call by call.
- Respect the dispute window: carrier terms require billing disputes in writing within 15 days of the invoice date. Reconciliation that runs monthly discovers waste after the window to contest it has already closed.
Related reading
The robot that said no: what onboarding an AI agent actually takes
Call records you can trust: real conversations onlyInnovation by Vasily Starostenko, founder of CallPages.