1. General: Should locking be:
  - Optimistic: Locks are not explicitly claimed. Writers must provide the 'last-seen value for modified_date' (or similar)
  - Pessimistic: Locks must be requested in advance and must have a TTL

2. General: Who can override a lock?
  - Everyone?
  - No one?
  - Folks with permission 'override lock'?

3. General: How does one override a lock?
  - Automatic: If one has permission to ignore locks, then the lock will be ignored.
  - Prompted: If one makes a 'save' which raises a lock conflict, prompt the user to decide
  - Manual: Go to a backend screen, find the lock, remote it.

4. At what level do the locks apply:
  - Individual database row
  - Contact-graph

5. What happens with legacy code (API callers, background tasks,
odds-and-ends) that does not explicitly understand the locking mechanism?

  - Legacy code is lock-free -- all writes succeed unless he caller opted to obey
    locking protocols.
  - Legacy code involves secret locking -- before making a write, data-layer
    (BAO/API) attempts to obtain a lock; if it fails, then it throws an exception.
    (This only makes sense for pessimistic locking.)

6. (For optimistic locks) How does the client determine the version/timestamp
-- and how does it pass it along with the corresponding update? How does
this work at BAO and API levels? e.g.

  $contact = civicrm_api('contact', 'get', ...);
  civicrm_api('email', 'create', array(
    'option.locktoken' => $contact['modified_time'],
  );

7. (For pessimistic locks) How is the lock claimed? (eg
$dao->lock()? CRM_Utils_Lock::claim(...)) How do we identify the holder of the lock?  How
is that identity passed along?  (e.g.  PHP SESSION ID could be used transparently but
probably doesn't work with REST consumers)

8. (For optimistic locks based on contact graph) How can we tell when a series of
updates are all related -- ie being updated at the same time by the same lock holder?  e.g.
This might break in oplocking because the 'modified_date' changes.  The problem affects API chaining (which is sugar for making a series of API calls):

  $contact = civicrm_api('contact', 'get', ...);
  civicrm_api('email', 'create', array(
    'option.locktoken' => $contact['modified_time'],
  );
  civicrm_api('phone', 'create', array(
    'option.locktoken' => $contact['modified_time'],
  );