METRIC
指标Metric
聚合趋势告诉你何时、多少请求异常。Aggregate trends reveal when and how many requests are abnormal.
01 ·
只看到“今天变慢了”，你知道该查哪一个请求吗01 · If a chart says today is slower, which request should you
inspect?
延迟指标突然升高，日志里有一条越权拒绝，trace 又显示检索超时——如果三者没有同一个 request_id，你能证明它们是同一次事故吗？Latency rises, a log records an authorization denial, and a trace shows retrieval timeout. Without one request_id, can you prove they belong to the same incident?
02注入超时、错检索或越权，让指标/日志/trace 三视图沿同一请求联动Inject Timeout, Wrong Retrieval, or Unauthorized Access and Link Metrics, Logs, and Trace on One Request
一个请求 · 三种证据one request · three evidence views
状态 AMetric A
—
—
状态 BMetric B
—
—
状态 CMetric C
—
—
所有概率、分数、成本、token 与输出均为固定种子的教学模拟，不代表真实模型输出。把主变量拖回即可复核结论。All probabilities, scores, costs, tokens, and outputs are fixed-seed teaching simulations, not real model output. Move the main variable back to verify the conclusion.
03把刚才的变化拆成 4 个零件Break the Change into Four Parts
ObservabilityLOG
结构化日志Structured log
事件字段说明发生了什么与判定原因。Event fields explain what happened and why it was classified that way.
TRACE
调用追踪Trace
span 显示故障发生在哪一站以及上下游关系。Spans show which stage failed and its upstream and downstream relationships.
LINK
关联键Correlation key
统一 request_id 把三视图锁到同一事实。One request_id locks all three views to the same event.
04最小机制：主交互能逐项验证Minimal Mechanism: Verify Each Link in the Interaction
MECHANISM
incident_evidence = metric ∩ log ∩ trace by request_id
主交互每次注入只生成一个固定
request_id；三视图必须同时更新并能回到同一请求链。Each injection creates one fixed request_id. All three views must
update together and return to the same request chain.
注入故障Inject fault一个请求发生异常one request fails
发出三类信号Emit three signals指标 / 日志 / spanmetric / log / span
按 ID 汇合Correlate by ID定位并回放locate + replay
05注入越权，但让日志缺失 request_idInject Unauthorized Access but Drop request_id from the Log
主动制造失败Create a failure边界实验Boundary experiment
信号都存在不等于可关联。缺少统一键时只能猜测因果，事故证据链应亮断裂警告。Having every signal does not make them correlatable. Without a shared key, causality is guesswork and the incident chain must show a break.
尚未执行。先在主交互中观察正常机制。Not run yet. Observe the normal mechanism in the main interaction
first.
✗ 有监控大盘就等于可观测。A monitoring dashboard equals observability.→ ✓ 还要能从异常下钻到日志和单请求
trace。You must drill from anomalies into logs and a single-request
trace.
✗ 日志越多越容易定位。More logs always improve diagnosis.→ ✓ 结构化字段、关联键与采样策略比文本堆积更关键。Structured fields, correlation keys, and sampling matter more
than text volume.
✗ trace 只需记录成功路径。Traces only need successful paths.→ ✓ 失败 span 与上下游状态才是定位证据。Failed spans and upstream/downstream states are core diagnostic
evidence.
06 · 一句话带走06 · One line to keep