Distributed locks can expire correctly yet still corrupt data

A worker acquires a distributed lock with a 10-second TTL, freezes for 12 seconds, and the lock expires. Another worker acquires the lock and completes the update, but the first worker then overwrites the data. The issue is that leases cannot recall code after expiration, and the fix is a fencing token enforced by the resource.