Fencing tokens

Each new lock holder receives a higher number, and storage rejects writes carrying an older one. A paused old leader that wakes up cannot corrupt data.