The write-boundary requirement is the part many lock implementations miss. If the final side effect is an object store, message broker, or third-party API that cannot atomically compare the generation, the fencing token is only evidence, not enforcement. One practical pattern is to write through a small authoritative service or database row that records the highest accepted token and an idempotency key before emitting the external effect. I would test delayed requests explicitly by holding token N, committing N+1, then releasing N and proving every downstream path rejects or deduplicates it.