Distributed Lock Service · View 02 of 26 · 1 · Context and scope
Decisions
- Callers never talk to etcd. The arbiter owns epoch checks, class rules, quotas and the wait queue, and it is the only thing holding an etcd write credential for grants.
- The arbiter is stateless for correctness. Every fact about who holds what is in etcd, so any arbiter replica can die mid-request without leaving a grant behind that the log does not know about.
- The audit trail is read from the log's own change stream. Nothing writes to two places, so a grant cannot exist without its audit event eventually existing.
The number that matters
- Every acquire and every release is one Raft commit with an fsync on a majority. That round trip, not arbiter CPU, is the cost and the throughput ceiling.
- Renewal is not on this path. It rides the session lease, which is why 250,000 held leases do not cost 50,000 writes a second.
Risks
- The write-with-token arrow is the one reviewers skim past. If a resource ignores the token, everything upstream of it is a scheduling hint.
