Steps 5 to 7 — the Valkey round trip — are skipped on roughly 92% of requests, where the pod-local lease still has capacity. That is where the latency budget comes from.
The reservation is taken before the response is returned, not after. A request that is allowed but never executed still holds quota until the reaper releases it, which is the correct conservative behaviour.
Commit is asynchronous and off the caller's critical path. The tenant's response is not delayed by accounting.
Latency budget
Envoy filter overhead 0.4 ms · scope resolution from cache 0.1 ms · local lease check 0.2 ms.
On a lease miss: Valkey EVALSHA 1.5 ms p99 · reservation write 0.6 ms · total 6 ms p99.
Budget: 10 ms p99 for the decision. Measured p99 across the mix, 6.2 ms; p50, 0.5 ms.
Failure behaviour
If step 5 times out at 3 ms, the pod falls back to its local bucket and the tenant's fail_mode decides the verdict — view 23 has the ladder.
If step 12 never arrives, the reservation expires after 120 s and the reaper releases it. The tenant loses that quota for the interval; it is never lost permanently.
A duplicate commit for the same request_id is a no-op, because reservation state moves HELD → COMMITTED once.
