# Distributed Lock — Manual Review Checklist

High-risk module: distributed-lock changes require architecture confirmation.

- [ ] Lock has a TTL / expiry — no permanent deadlock after crash
- [ ] Lock release is atomic and ownership-checked (compare-and-delete)
- [ ] Lock scope is correct (key includes the right entity identifiers)
- [ ] Renewal / watchdog exists for long critical sections
- [ ] Locking order is consistent across paths (no lock-ordering deadlock)
- [ ] Fencing tokens / version check prevents stale-holder writes
- [ ] Fail-open vs fail-closed behavior is intentional and documented