A service takes a distributed lock, starts writing, then freezes — a long garbage-collection pause, 20 seconds.
The lock's TTL expires. The system assumes the holder died. A second service takes the lock and writes.
Then the first one wakes up. It has no idea any time passed. It finishes its write.
Two writers. Both believed they held the lock. Both were right, briefly.
You cannot fix this with a longer timeout. A pause can always be longer, and a network partition looks identical from the outside.
The fix is at the storage, not the lock:
| Step | What it returns |
|---|---|
| Lock granted | Also returns a token: 33 |
| Next holder | Token: 34 |
| Storage rule | Reject anything with a token lower than the last one accepted |
The old writer returns with token 33. Storage has seen 34. Refused.