Distributed Lock Service · View 21 of 26 · 6 · Operations
Decisions
- Lock metrics are labelled by namespace and class only. The per-key question is answered by the inspection API, which reads etcd, not by a time series.
- Expiry without release is a client-health signal routed to the owning team, not an error rate on the platform. It means holders are dying or pausing, which is a fencing question.
- Longest current hold per namespace is a first-class gauge, because the oldest hold is the most likely leak.
Consensus health
- WAL fsync p99 above 10 ms, backend commit p99 above 25 ms, more than one leader change an hour and DB size above 70% of quota each page the platform team. Each precedes a grant-latency incident by minutes.
The token is a capability
- Client libraries never put the token in a span attribute, log line or error message. The OTel Collector also runs a redaction processor on the lock.token attribute, as a second line rather than the first.
