Redlock's five masters are the price of a lock that survives failover

Start with what the 30-second expiry in `SET resource:order-42 my-random-value NX PX 30000` actually covers: a client that crashes while holding the lock, which the TTL then releases on its behalf ^[2]. Failover is a different hole. The write lands on the master, the master dies before the key reaches the replica, the replica is promoted, and the new master has no record that anyone holds anything ^[3]. No amount of TTL tuning reaches that.

Redlock's answer is arithmetic. Five independent masters and a majority rule of N/2+1 mean three have to accept the SET for the lock to count ^[4][5][1]. Because any two majorities of five share a node ^[8], two clients cannot both be told yes. The tolerance you buy is two failures out of five, which is 40 percent of the fleet unreachable before the lock stops working ^[4]. What you cannot do is reuse the highly available Redis you already run: the five must not replicate to or coordinate with each other ^[4], so a primary and its replica are one node for this purpose, not two.

The acquisition loop is where the cost shows up at runtime. The client walks the instances one at a time with a short per-instance timeout so a dead node does not stall the attempt ^[5], then subtracts elapsed time and an allowance for clock drift from the TTL to get the validity it may actually use ^[6]. A node that is slow rather than dead is the expensive case: it answers, it counts toward the quorum, and it bills the difference to your working window.

Then the clocks. If one node's clock jumps forward, from a bad NTP sync, a VM pause and resume, or a manual change, that node expires the lock while the others still consider it held, and two clients believe they own it ^[10]. Even with all five behaving, a client that pauses long enough for its lock to expire can wake and carry on writing as though nothing happened ^[11]. The mitigation is a monotonically increasing token issued with every grant, which the resource compares and rejects when it is lower than one already seen ^[12], enforced by the database, file store or API being protected rather than by Redis ^[13].

That is the part to price. If your store can reject a stale token, it is already refusing the second writer, and the five masters are buying you less duplicated work rather than mutual exclusion. If it cannot, the five masters do not close the pause window either.