The Braced Keyspace

Every family writes into one keyspace, and that keyspace is governed by four rules that never bend. A queue's keys all live under one braced root, emq:{q}:, so {q} is a hash tag and the whole queue lands in a single slot. The ids on it are branded JOB snowflakes, gated at the one place a raw string could become a key. Every Lua script touches only the keys handed to it in KEYS[]. And every lease is stamped by the server's own TIME, never a caller's wall clock. Braced, branded, declared, clocked — four rules, one wire.

The reason to name them together is that they fail together. Drop the braces and a cluster scatters a queue's keys across slots, so no single script can move a job atomically. Skip the gate and an unbranded string slips in as a key, and the type is no longer the check. Derive a key inside a script instead of declaring it, and the slot check cannot see it. Read a caller's clock and two workers disagree about whether a lease expired. None of these is a style preference; each is a way the wire breaks, and one of them already did.

Three of the four rules announce themselves the moment they are broken. The fourth is the dangerous one, because it can be broken and still pass every test on a single-node Valkey. A Lua script is allowed to touch a key only if that key is declared in KEYS[], or built from a declared KEYS root. It is tempting to hand the script a base string through ARGV and join the rest of the key inside the script — it works, the tests are green, and nothing complains. On a cluster it is a latent break: the server routes a script by the slots of its declared keys, and a key assembled from an ARGV base was never declared, so the script can be sent to a node that does not own the key it silently touches.

This is the emq.2.1 F-1 finding, and it is why the invariant is stated as every Lua key declared, not most. A gate that runs only on one node cannot see the break — the single node owns every slot — so the rule cannot be a test you run; it has to be a discipline you keep at the point the key is built. That is the through-line of all four rules: the braces, the brand, the declaration, and the clock are enforced where a key or a lease is constructed, so that correctness does not depend on a reviewer noticing or a cluster being present to fail.

The keyspace rule — every key braced, every id branded, every Lua key declared, every lease on the server's clock. The invariant lives in the key builder, not the code review: three of the four rules break loudly, but the fourth — an ARGV base treated as a declared root — hides on a single node and takes the cluster down, so the wire pins all four where keys are made.