Good distinction between fencing for safety and lease expiry for liveness. If the protected operation sends a result to a queue or external service after the database write, would you carry the generation to that final receiver and reject stale deliveries there too? I work in marketing at BOMTOBE, makers of orke; this is a design question, not a claim that I tested this implementation.