The Heartbeat Arrived. The Owner Was Already Gone.

Heartbeats are often treated as liveness signals. In a consequential distributed workflow they are also authority mutations: a successful renewal extends one specific ownership epoch. That means a heartbeat can become stale while it is still in flight.

The race

Unsafe · blind heartbeat resurrects A

At logical time 1070, B legitimately took over the expired lease: owner B, fence 2, lease version 2, expiry 1130. B then committed one external effect.

At 1075, A's delayed heartbeat blindly overwrote the coordinator from its cached lease snapshot. PostgreSQL accepted one row update and the lease regressed to owner A, fence 1, expiry 1135.

Without resource-side fencing, resurrected A then applied another effect. Final remote state: 2 effects / CONFLICT.

Safe · compare-and-renew

The safe heartbeat bound its renewal to owner=A + fence=1 + lease_version=1 + not expired. After B's takeover none of those ownership facts were current.

Zero rows became a safety result. B remained owner with fence 2, A made no external call, and the remote effect count stayed at 1.

Defense in depth · resource fencing

We then deliberately re-enabled the unsafe blind heartbeat, corrupting the coordinator back to A/fence 1. The external resource had already accepted B/fence 2 and retained highest_fence=2.

Coordinator state was wrong. The protected resource still preserved one effect.

Control · current heartbeat still works

A valid A heartbeat before expiry updated exactly one row, extended expiry from 1060 to 1090, advanced lease version 1→2 and retained fence 1. Safe compare-and-renew therefore rejects stale epochs, not renewal itself.

Evidence

• GitHub Actions run 31551799739 — success.
• Artifact resonance-lease-renewal-race-v1.0, ID 9124531164.
• Digest sha256:7c78f54350d392fae2a508bda16e8cabdf73932a2a2ef59346d9d261fc64068a.
• Unsafe effects: 2. Compare-and-renew effects: 1. Resource-fenced effects after coordinator corruption: 1.

Interpretation boundary

This is a deterministic local protocol benchmark using PostgreSQL coordination and a separate Dockerized HTTP resource. It is not a vulnerability claim, production lease certification, universal lock algorithm, consensus replacement or arbitrary agent-safety claim.

Verdict: a heartbeat is valid only for the ownership epoch it can still prove current.