Data integrity protection in Drupal 10.x - how lock conditions might fail

Question

I was doing some pentesting on a Drupal 10.x application that some colleagues built; I have not reviewed the source code. The dynamic vulnerability scanner I use provoked some exceptions related to a failure to obtain locks on various objects. Does the Drupal developer have to handle the results of locking failure when using something that would use locking? The exception is just failure to acquire the lock on some object thus and so. I read this as it just timed out, but am trying to make sure that for example the data store is the sort that even supports locking; the documentation suggests but seems to contradict also the idea that only databases (and not memory stores) support locking. As a side note, and perhaps a way to answer my own question: what sort of references are good for understanding nitty-gritty architectural questions about implementation of Drupal? (Rather than merely the API documentation.) I'll be cross-posting this on the Drupal SE site (IIRC, there is one), so if anyone is on both, forgive the dup.