SLO 先回答三个问题，再谈 99.9%

package sli

import (
    "net/http"
    "time"

    "github.com/prometheus/client_golang/prometheus"
)

// 不给每个接口建指标，只给进 SLO 契约的旅程建：journey x outcome 两个 label，基数可控
var journeyEvents = prometheus.NewCounterVec(
    prometheus.CounterOpts{
        Name: "journey_events_total",
        Help: "用户旅程事件计数",
    },
    []string{"journey", "outcome"},
)

type respWriter struct {
    http.ResponseWriter
    status   int
    degraded bool // handler 主动标记：这次返回的是降级结果
}

type rule struct {
    journey   string
    latencyOK time.Duration // 阈值取用户开始流失的位置，不是机器能跑多快
}

// 只有 SLO 覆盖的路由才计数，无关请求混进分母只会稀释信号
var rules = map[string]rule{
    "/api/checkout": {journey: "checkout", latencyOK: 800 * time.Millisecond},
    "/api/search":   {journey: "search", latencyOK: 300 * time.Millisecond},
}

func Middleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        rl, ok := rules[r.URL.Path]
        if !ok {
            next.ServeHTTP(w, r)
            return
        }
        start := time.Now()
        rw := &respWriter{ResponseWriter: w, status: http.StatusOK}
        next.ServeHTTP(rw, r)

        outcome := "good"
        switch {
        case rw.status >= 500 || rw.status == http.StatusTooManyRequests:
            outcome = "bad" // 5xx 是失败；429 是我们自己拒绝的，同样是用户视角的失败
        case time.Since(start) > rl.latencyOK:
            outcome = "bad" // 慢过阈值，对用户来说和失败没有区别
        case rw.degraded:
            outcome = "bad" // 降级先从严算坏；要放宽就改 SLO 文档，别靠代码里的即兴判断
        }
        journeyEvents.WithLabelValues(rl.journey, outcome).Inc()
    })
}

package budget

import "time"

// Budget 把 SLO 目标换算成可执行的量：剩余比例、燃烧率、预计耗尽时间
type Budget struct {
    Target  float64       // 目标，如 0.999
    Window  time.Duration // 窗口，如 30 * 24 * time.Hour
    Total   float64       // 窗口内已发生的总事件数
    Good    float64       // 其中好事件数
    Elapsed time.Duration // 窗口已走过的时间
}

// BurnRate 当前坏事件率相对预算坏事件率的倍数，1.0 表示正好踩线
func (b Budget) BurnRate() float64 {
    if b.Total == 0 {
        return 0
    }
    return (1 - b.Good/b.Total) / (1 - b.Target)
}

// RemainingFraction 预算剩余比例，负数表示已烧穿
func (b Budget) RemainingFraction() float64 {
    if b.Total == 0 {
        return 1
    }
    // 按当前流量外推整个窗口的总事件数，再算允许的坏事件总量
    projected := b.Total * b.Window.Seconds() / b.Elapsed.Seconds()
    allowedBad := (1 - b.Target) * projected
    return 1 - (b.Total-b.Good)/allowedBad
}

// ExhaustionAt 按当前坏事件速度线性外推耗尽时刻；烧不完返回零值
func (b Budget) ExhaustionAt(now time.Time) time.Time {
    if b.Elapsed <= 0 {
        return time.Time{}
    }
    badPerSec := (b.Total - b.Good) / b.Elapsed.Seconds()
    remaining := (1 - b.Target) * b.Total * b.Window.Seconds() / b.Elapsed.Seconds() * b.RemainingFraction()
    switch {
    case remaining <= 0:
        return now // 已经烧穿
    case badPerSec <= 0:
        return time.Time{} // 没有坏事件在发生
    }
    return now.Add(time.Duration(remaining / badPerSec * float64(time.Second)))
}

b := Budget{Target: 0.999, Window: 30 * 24 * time.Hour,
    Total: 8.2e6, Good: 8180320, Elapsed: 10 * 24 * time.Hour}
fmt.Printf("burn=%.1f remaining=%.0f%% exhaust_in=%.1fd\n",
    b.BurnRate(), b.RemainingFraction()*100,
    time.Until(b.ExhaustionAt(time.Now())).Hours()/24)
// burn=2.4 remaining=20% exhaust_in=2.5d：窗口才过 1/3，预算只剩两成

groups:
  - name: sli-journey
    interval: 30s
    rules:
      # 5 分钟 / 6 小时两个燃烧率；clamp_min 防止无流量时段除零
      - record: sli_journey_burn_5m
        expr: |
          (1 - sum by (journey) (rate(journey_events_total{outcome="good"}[5m]))
              / clamp_min(sum by (journey) (rate(journey_events_total[5m])), 1e-12)) / (1 - 0.999)
      - record: sli_journey_burn_6h
        expr: |
          (1 - sum by (journey) (rate(journey_events_total{outcome="good"}[6h]))
              / clamp_min(sum by (journey) (rate(journey_events_total[6h])), 1e-12)) / (1 - 0.999)

# error-budget-policy.yaml：变更走 review，和代码同等对待
journey: checkout
slo:
  target: 0.999
  window: 720h # 滚动 30 天
policy:
  - trigger: remaining < 0.5 && window_elapsed < 0.3   # 慢性泄漏
    action: freeze_feature_launch                       # 冻结功能发布，只做可靠性工作
    owner: checkout-team
    exit: remaining > 0.65 持续 48h                     # 留缓冲再解冻，防止贴线反复横跳
  - trigger: remaining <= 0
    action: reliability_only                            # 只允许 bug 修复与降风险变更
    escalate: 24h 未恢复升级到工程负责人
exceptions: [security_patches, legal_compliance] # 安全与合规变更不受冻结限制，事后复盘