Distributed Locks Can Expire Correctly and Still Corrupt Data Without Fencing Tokens

A distributed lock expiring on schedule does not prevent data corruption if a paused worker resumes and overwrites a newer update after its lease has already been claimed by another process. This is because distributed locks are effectively leases — they communicate ownership for a time window but cannot cancel in-flight writes or recall delayed network packets. A real-world parallel is the 2012 GitHub outage, where a ~90-second network disruption caused multiple file-server pairs to simultaneously believe they were the active owner of the same resource, requiring over five hours of recovery. The reliable fix is a fencing token: a strictly increasing integer issued by the lock coordinator on each acquisition, which the protected resource uses to reject any write carrying an older generation number. Unlike a random UUID — which only prevents an expired holder from releasing another's lock — a fencing token enforced at the storage layer ensures stale writes are rejected regardless of network or process delays.