Review of #134577 found two ways the lock tolerance could still outlive
the lease row, letting a successor reclaim it under a running turn:
- The local deadline was taken AFTER acquisition/renewal returned, while
the store stamps expires_at BEFORE its write-lock wait, so a renewal
that waited 20s gave the turn 20s more than the row. The deadline now
starts from the admitted row's committed expiry
(SessionDB.session_turn_lease_expires_at) and from a timestamp taken
before each successful renewal; neither can exceed the row.
- A retry that started before expiry could block in the write-lock wait
past it. Each renewal's write patience is now capped at the remaining
authority minus a 2s margin (refresh_session_turn_lease patience_s),
and the next-tick check budgets that margin too.
Test: real SessionDB + a second-connection write lock. Red on the PR head,
green here; the lock-clears control renews with no interrupt.
b8788c3cb1