Your platform exposes 9 capabilities to 420 services and every deprecation needs one question answered - which services called this capability in the last 90 days? Fleet-wide the platform APIs take about 3000 calls per second. Which telemetry design answers that question at a cost you can keep paying?

The assumptions and the arithmetic

The question is a set-membership question - did this caller appear at all - not an analytical one. That shapes the sizing.

Counters. The series count is bounded by capabilities times callers: 9 × 420 = 3,780 series at the absolute worst, and in practice far fewer because most services touch two or three capabilities. Scraped once a minute for 90 days that is 3,780 × 1,440 × 90, about 490 million points. A time-series store holds a point in roughly 1 to 2 bytes after delta and compression, so the whole 90-day attribution record is on the order of 1 GB.

Full access log. 3,000 calls per second for 90 days is about 2.3 × 10^10 records. At 200 bytes each that is roughly 4.7 TB raw, maybe 0.5 to 1 TB compressed in columnar storage. It answers far more questions and costs three orders of magnitude more to keep for the one question that drives deprecations.

1% trace sample. About 230 million records, perhaps 50 GB, and it answers the question wrongly. A monthly batch job making 3 calls a month produces 9 calls in 90 days, and the chance any of them is sampled is 1 - 0.99^9, under 9%. The callers sampling loses are exactly the ones that break when you remove the capability.

The number and what it rules out

One gigabyte a quarter rules nothing out, so the real finding is that attribution is affordable at any scale and the usual reason a platform cannot hold a deprecation date is that nobody turned the counter on, not that the data was too expensive. It also rules out the common compromise of shortening log retention to 7 days: a 90-day window is the minimum that catches monthly and quarterly callers.

Why the other options fail

• The 1% trace sample is already there in most estates, which is why teams reach for it. Sampling is designed to preserve aggregate shape and to discard rare events, and rare callers are the entire question.
• The full access log is correct and over-provisioned. Keep it for 7 to 14 days for debugging a specific call, and do not make the deprecation programme depend on a bill that finance will cut.
• The code search misses the cases that matter: a caller invoking the API over HTTP without the client library, a dependency pulled in transitively, and code that is committed but not deployed. It also tells you nothing about whether a path still runs.

When this is the wrong answer

If calls do not carry a trustworthy caller identity, no counter design helps and the first piece of work is authenticating callers so the label means something. And when a capability has three consumers you know by name, a counter is ceremony - send three messages.