docs(diagnostics): address code review suggestions

- Add note about ephemeral query fingerprints (change on restart)
- Make default 2000ms threshold more prominent in docs
- Use display formatting for cleaner warning logs in production

Author: tobyhede

docs/SLOW_STATEMENTS.md

@@ -10,7 +10,8 @@ Enable slow statement logging via environment variables:
 # Enable slow statement logging (required)
 CS_LOG__SLOW_STATEMENTS=true
 
-# Optional: Set minimum duration threshold (default: 2000ms)
+# Optional: Set minimum duration threshold
+# Default is 2000ms (2 seconds) - only set this if you want a different threshold
 CS_LOG__SLOW_STATEMENT_MIN_DURATION_MS=500
 
 # Optional: Set log level (default: warn when enabled)
@@ -46,6 +47,10 @@ When a statement exceeds the threshold, the proxy logs a detailed breakdown:
 }
 ```
 
+### Query Fingerprints
+
+**Note:** Query fingerprints are ephemeral and instance-local. Each proxy instance generates a unique random key at startup used to compute `query_fingerprint` values. This means fingerprints will change when the proxy restarts and cannot be correlated across different proxy instances. This is intentional for security (prevents dictionary attacks on query patterns). Use fingerprints for correlation within a single proxy instance's runtime only.
+
 ## Prometheus Metrics
 
 ### Labeled Histograms

packages/cipherstash-proxy-integration/src/diagnostics.rs

@@ -77,4 +77,32 @@ mod tests {
             "Metrics should include multi_statement=false label"
         );
     }
+
+    #[tokio::test]
+    async fn slow_statement_metrics_and_logs() {
+        let client = connect_with_tls(PROXY).await;
+
+        clear().await;
+
+        // Execute a query that takes longer than the default 2s threshold
+        // We use pg_sleep(2.1) to ensure it's considered slow
+        client.query("SELECT pg_sleep(2.1)", &[]).await.unwrap();
+
+        // Fetch metrics with retry logic
+        let body =
+            fetch_metrics_with_retry(METRICS_FETCH_MAX_RETRIES, METRICS_FETCH_RETRY_DELAY_MS).await;
+
+        // Assert that the slow statements counter incremented
+        assert!(
+            body.contains("cipherstash_proxy_slow_statements_total 1"),
+            "Metrics should include slow statement counter incremented to 1. Found: {}",
+            body
+        );
+
+        // Verify that duration histograms also reflect the slow query
+        assert!(
+            body.contains("cipherstash_proxy_statements_session_duration_seconds_bucket"),
+            "Metrics should include session duration histogram"
+        );
+    }
 }

packages/cipherstash-proxy/src/postgresql/context/mod.rs

@@ -444,7 +444,7 @@ where
             warn!(
                 target: CONTEXT,
                 client_id = self.client_id,
-                prepared_statement = ?name,
+                prepared_statement = %name.as_str(),
                 msg = "Session lookup failed for prepared statement, using latest session"
             );
         }