I43 · Do not resurrect superseded ownership
Once takeover advances the ownership epoch from fencing token N to N+1, a delayed heartbeat from the N owner must not make N current again.
I44 · Renewal is a compare-and-mutate operation
Renewal should succeed only while all facts that established the caller's current ownership still match at the renewal boundary.
I45 · Zero rows is safety evidence
A failed renewal comparison is not permission to retry a blind update. It proves the cached lease is no longer enough to authorize extension.
I46 · Keep the resource fence
Coordinator compare-and-renew protects the lease record. The protected resource must still compare a monotonic fencing token, because coordinator state itself can be corrupted or become stale.
Canonical chain
Evidence fields
Preserve worker identity, resource identity, fence, lease version, expiry, renewal preconditions, renewal row count/classification, takeover state, resource-side highest fence, external mutation result and final reconciliation.
Observed benchmark result
Verified #021 reproduced two effects after blind late-heartbeat resurrection. Compare-and-renew produced zero rows and preserved one effect. When coordinator state was deliberately corrupted, resource-side fencing returned HTTP 409 and still preserved one effect.
Boundary
This is an experimental RESONANCE protocol rule derived from a deterministic PostgreSQL + local HTTP benchmark. It does not prescribe one universal lease implementation or replace consensus, transactions or provider-specific concurrency guarantees.
Inspect
TTP Lease Renewal Rule
current owner → current epoch → conditional renewal → fenced mutation.