Death, more than contention, is what makes this hard. The claim file is a promise that some worker is working, and a SIGKILL or a deploy leaves the promise standing without the worker, at which point the file is a tombstone that blocks that call forever [7]. So the design needs a TTL and a way to take a claim back, and the take-back runs into a constraint most application code never has to see: POSIX has no delete-this-inode, only unlink of a path, and between the moment you judge a claim stale and the moment you remove it, that path can point at a fresh claim somebody else just won [8].
Two processes reading the same stale timestamp are both entitled to act on it. A unlinks, wins the create, starts charging. B, holding bytes it read a microsecond earlier, unlinks A's brand-new claim, wins, and charges the same customer again [9]. The suite stayed green because expiry was probed with a single caller while concurrency was probed from an empty directory, so the defect sat in the gap between two passing tests [10]. Serializing the takeover with a sentinel file and a POSIX flock made the tests green again [12] and left the protected branch as unlink-then-recreate against a timestamp that can be stale, which reproduced twenty double executions out of twenty [14]. The author's own summary is the best line in the writeup: "I had added a lock to guard a copy of the bug I was fixing" [15].
The other finding in that round is quieter and travels further. The lock was scoped to the claim directory rather than to the key, so four unrelated charges that were racing nothing blocked each other and most were refused [16], and the project README rates a missed charge as the worse half of the trade [17]. This is a key-to-path mapping problem, not a locking defect: it decides who competes.
Generations remove the operation rather than debug it: an expired claim stays put, a new `<sig>.genN.claim` opens beside it, and no take-back call exists to get wrong [18]. The acceptance test is a grep that returns zero matches for unlink, rename, os.replace and flock in the guard module [19], which is checkable in CI by someone who knows nothing about concurrency. The clean runs are 0 of 20 forced interleavings, plus 16 workers across 40 trials [20], so 640 executions with no duplicate [23].
Read the 40-to-1 table as a measurement of one host [5]. For it to transfer you need create-exclusive to be atomic on whatever filesystem holds the claim directory, and you need every racing worker to derive the identical path from the identical key. The NFS remark in the source is about flock degrading to a no-op, not about O_EXCL [13], so it certifies nothing about a network share; it warns that a lock layered on top may be decoration.
Adoption cost lands on the reading side. After four rounds of review the eleven open defects were all there [21][22], in questions like how old a claim is when the claim wrote its own timestamp [25].
