diff --git a/CHANGELOG.md b/CHANGELOG.md
index b497a91ec..f55f67785 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2852,6 +2852,20 @@ breaking.  See `ROADMAP.md` for what's coming, and `README.md` →
 
 ### Changed
 
+- **`LeaseMajority` relies on `checkAlive()`, and the derived lease renewal
+  interval is capped at half the TTL** (#937).  `LeaseMajority` re-validates
+  a won arbitration with `lease.checkAlive()` before returning it again, so
+  a custom `Lease` has to answer it against its TTL: `true` while held and
+  the TTL has not run out since the last accepted write was sent.  One that
+  answers a constant `false` never keeps a win; one that answers a held flag
+  keeps working, without the stall protection.
+
+  An unset `renewalIntervalMs` was a third of the TTL with a floor — 100 ms
+  for `InMemoryLease`, 500 ms for `KubernetesLease` — and the floor alone
+  renewed a TTL at or below it only after the record had lapsed.  That now
+  gives the lease up, so the derived interval is capped at half the TTL.  An
+  interval set explicitly is taken as given.
+
 - **Every broker image is pinned to a release, every runner image to a
   digest, and Dependabot watches both — and the .NET benchmark arms**
   (#1597). Sixteen of the seventeen `image:` lines in the integration compose
@@ -3508,6 +3522,14 @@ breaking.  See `ROADMAP.md` for what's coming, and `README.md` →
 
 ### Fixed
 
+- **`InMemoryLease` arms one renewal loop, however often it is acquired**
+  (#937).  A re-`acquire()` on a lease the instance already held overwrote
+  the timer handle and left the first interval armed for good: past
+  `release()` it fired on nothing but kept a real-timer process alive, and
+  after the next acquire it renewed again beside the second loop.
+  `LeaseMajority` re-acquires exactly like that, since it never releases a
+  lease it won.
+
 - **The multi-node integration run went red the moment a node exited
   cleanly — which, since #1567, scenario 13's victim does** (#1594).
   `bun run test:integration` ran compose with `--abort-on-container-exit`,
@@ -4792,6 +4814,37 @@ breaking.  See `ROADMAP.md` for what's coming, and `README.md` →
 
 ### Security
 
+- **A lease holder that stalled past its TTL no longer goes on believing it
+  holds the lease** (#937).  `checkAlive()` answered from a cached flag in
+  both `InMemoryLease` and `KubernetesLease`, and only a renewal that noticed
+  the loss ever cleared it.  A holder whose event loop stalled longer than
+  the TTL — a GC pause, a starved container — never ran that renewal, so it
+  still answered `true` while another node had legitimately taken the lease,
+  and the renewal that finally ran extended the lapsed record whenever nobody
+  had claimed it yet.  `LeaseMajority`, which caches the decision its lease
+  acquire produced, went on replaying a win the other side now held, and both
+  halves of a split acted as the survivor.
+
+  `checkAlive()` now compares against the deadline of the last write the
+  backend accepted, measured from when that write was sent, and turns
+  `false` at the deadline itself.  `KubernetesLease` judges it on two clocks
+  and lets either one end it: `performance.now()`, which NTP cannot step
+  back, and the wall clock, which still counts the time a suspended host
+  lost.  A renewal tick past the deadline fires `onLost` and extends nothing;
+  `KubernetesLease` checks ahead of its in-flight guard, so a renewal PUT
+  hanging for up to `operationTimeoutMs` no longer holds the report back.
+  `LeaseMajority` returns a cached win only while `checkAlive()` holds and
+  otherwise arbitrates again — it loses if the other side has the lease, and
+  wins it back if nobody took it.
+
+  Consumers that react to `onLost` — the singleton manager, the sharding
+  coordinator, persistence fencing — now hear about such a stall at the
+  first renewal after it, where the lapsed lease used to be extended
+  silently.  Fencing does not re-acquire, so a `PersistentActor` stays in
+  observer mode afterwards, as it already did after any other loss.
+  `InMemoryLeaseStore.renew` takes the caller's `now`, as `tryAcquire` has
+  since #1424, and refuses a lapsed record.
+
 - **The DevTools UI toolchain is installed frozen in CI, and the
   frozen-install guard reads through `bun run <script>`** (#1622).  Three
   workflows installed the nested Angular toolchain as `bun run ui:install`,
diff --git a/docs/src/content/docs/cluster/downing-strategies.mdx b/docs/src/content/docs/cluster/downing-strategies.mdx
index f03166959..bcf9c5703 100644
--- a/docs/src/content/docs/cluster/downing-strategies.mdx
+++ b/docs/src/content/docs/cluster/downing-strategies.mdx
@@ -464,6 +464,30 @@ rules cover both:
 The visible symptom of a lease provider having a bad day is
 therefore a cluster that waits, not one that splits.
 
+### When a win outlives its lease
+
+A win is only as good as the lease behind it.  Once the view has
+been stable for `stable-after`, the cluster asks the strategy again
+on every failure-detector tick, so a cached win can be returned
+long after the acquire that produced it.  A node that stalled past
+the lease's TTL in between — a long GC pause, a starved container
+— has lost the lease to the other side, which is by then downing
+*this* one.  Replaying the old win is how both halves end up acting
+as the survivor.
+
+So before a won decision is returned again, the strategy asks
+`lease.checkAlive()`.  If the lease has run out, the win is dropped
+and the side arbitrates afresh: the new acquire loses if the other
+side holds the lease now — and this side then downs itself — and
+wins it back if nobody took it.  A lost arbitration is not re-asked;
+it does not rest on the lease.  This relies on the backend answering
+`checkAlive()` against its TTL rather than from a held flag, which
+both built-in backends do (#937).
+
+An acquire that takes longer than the lease's TTL can never produce
+a usable win: the strategy keeps arbitrating and decides nothing,
+the same posture as while an acquire is pending.
+
 ## Picking a strategy
 
 Three questions in order:
diff --git a/docs/src/content/docs/coordination/in-memory-lease.mdx b/docs/src/content/docs/coordination/in-memory-lease.mdx
index d0f384862..dde9bc113 100644
--- a/docs/src/content/docs/coordination/in-memory-lease.mdx
+++ b/docs/src/content/docs/coordination/in-memory-lease.mdx
@@ -102,19 +102,28 @@ The implementation:
 
 - **`acquire()`** atomically CAS-es the registry slot.  Returns
   `true` if it claimed; `false` if held by another owner.
-- **TTL expiry** — if the holder doesn't renew within `ttlMs`,
-  the registry releases automatically (a setTimeout-driven
-  cleanup).
-- **`onLost`** fires if another holder takes over (via the TTL
-  expiry mechanism) or if the registry is forcibly cleared.
-- **Renewal** runs on a `setInterval` at `renewalIntervalMs`
-  (default `ttl / 3`).
-
-`InMemoryLease` uses real timers (`setInterval`) and exposes no
-scheduler-injection hook — there is no `ManualScheduler` to wire
-in.  For deterministic lease-timing tests, mock `Date.now()`; to
-reset shared lease state between tests, clear the exported
-`inMemoryLeaseStore` singleton directly (`inMemoryLeaseStore._clear()`).
+- **TTL expiry** is lazy — nothing runs at the deadline.  A record
+  past its expiry is simply free: the next `acquire()` by another
+  owner takes it, and `inMemoryLeaseStore.peek()` stops reporting
+  it.
+- **`checkAlive()`** compares against that same expiry, so a holder
+  whose renewal did not come round in time reads `false` from the
+  deadline on, before anything has told it so.
+- **Renewal** runs every `renewalIntervalMs` (default a third of
+  the TTL with a 100 ms floor, capped at half the TTL).  A renewal
+  that only comes round after the deadline gives the lease up and
+  fires `onLost` instead of extending the lapsed record.
+- **`onLost`** fires when a renewal finds the record gone, held by
+  another owner, or past its deadline — the last is what a holder
+  that stalled past its TTL sees.
+
+Timers run on `setInterval` by default.
+`LeaseOptions.withScheduler(...)` puts the TTL, the renewal cadence
+and the acquire retries on a scheduler instead — with a
+`ManualScheduler`, a test advances thirty seconds of TTL without
+waiting for them.  To reset shared lease state between tests, clear
+the exported `inMemoryLeaseStore` singleton directly
+(`inMemoryLeaseStore._clear()`).
 
 ## Example: a singleton test
 
diff --git a/docs/src/content/docs/coordination/kubernetes-lease.mdx b/docs/src/content/docs/coordination/kubernetes-lease.mdx
index c23025827..aab712acf 100644
--- a/docs/src/content/docs/coordination/kubernetes-lease.mdx
+++ b/docs/src/content/docs/coordination/kubernetes-lease.mdx
@@ -399,15 +399,24 @@ fires `onLost`: ownership that cannot be confirmed may not be assumed.
 
 - A renewal PUT is rejected **and** the re-read shows a different
   `holderIdentity`, or no lease object at all.
-- The framework observes the lease was modified by someone else
-  (a probe GET before some critical operation).
-- Network partition prevents renewal for longer than `ttlMs`.
-
-It does **not** fire on a CAS conflict whose re-read still names this
-owner.  That is the holder conflicting with one of its own writes —
+- A renewal tick finds `ttlMs` already gone by since the last write
+  the API server accepted was sent — the event loop stalled, a
+  network partition kept renewals out, or the previous renewal PUT
+  is still hanging on the wire.  No PUT is sent: another pod may
+  hold the lease by now (#937).
+- A renewal fails outright (network error, a credential the API
+  server keeps rejecting).
+
+`onLost` does **not** fire on a CAS conflict whose re-read still names
+this owner.  That is the holder conflicting with one of its own writes —
 another controller bumping the object, or a re-`acquire()` racing a
 renewal — and the record is still ours.
 
+`checkAlive()` turns `false` at the TTL deadline itself, without
+waiting for a tick.  The deadline is judged on two clocks and passes
+when either says so: the monotonic one, which NTP cannot step back,
+and the wall clock, which still counts the time a suspended host lost.
+
 The handler should drop ownership state immediately — see
 [Lease API](/coordination/lease-api/) for the contract.
 
diff --git a/docs/src/content/docs/coordination/lease-api.mdx b/docs/src/content/docs/coordination/lease-api.mdx
index 08d639fd9..53c7e2faa 100644
--- a/docs/src/content/docs/coordination/lease-api.mdx
+++ b/docs/src/content/docs/coordination/lease-api.mdx
@@ -130,20 +130,28 @@ if (lease.checkAlive()) {
 ```
 
 A **synchronous, local** check.  No network roundtrip.  Returns
-the holder's most-recent knowledge of "do I still own this?"
-
-Used by the framework to gate ownership-dependent work — e.g.,
-before issuing a shard allocation, the coordinator calls
-`checkAlive()` and aborts if it returns `false`.
-
-Implementations track ownership locally; the backend's renewal
-loop updates the local flag.  This means `checkAlive()` reflects
-**up to one missed renewal of staleness** — a sub-second window
-where the lease might actually be gone but `checkAlive()` still
-returns `true`.
-
-For absolute certainty, use `onLost(...)` and react to the
-notification rather than polling.
+`true` while this process holds the lease **and** its TTL has not
+run out — measured from when the last write the backend accepted
+was *sent*, so the local deadline is never later than the one
+other holders judge the record by.
+
+The answer rests on that deadline, not on a flag.  A flag is only
+cleared by a renewal that notices the loss, and a stalled event
+loop — a GC pause, a starved container — is exactly what keeps
+that renewal from running, while another holder may legitimately
+take the lease in the meantime.  So `checkAlive()` turns `false` at
+the deadline itself, before `onLost` has had a chance to fire
+(#937).
+
+`LeaseMajority` re-validates a won arbitration with it before
+acting on that win again.  The singleton manager, the sharding
+coordinator and persistence fencing react to `onLost` instead.
+
+The two answer at different moments.  `checkAlive()` turns `false`
+at the deadline; `onLost(...)` fires at the first renewal after it,
+up to one renewal interval later.  Gate each piece of work with
+`checkAlive()`, and register `onLost(...)` to stop ongoing work
+rather than polling.
 
 ## `onLost(handler): () => void`
 
@@ -159,13 +167,16 @@ const unsubscribe = lease.onLost((reason) => {
 Register a callback fired when ownership is lost **unexpectedly**:
 
 - The backend reported the lease was taken over by another holder.
-- The TTL expired without successful renewal (e.g., network
-  partition).
+- The TTL ran out without a successful renewal (e.g., network
+  partition, or a stalled event loop).  The first renewal tick
+  after the deadline reports it, and gives the lease up rather
+  than extending the lapsed record — another holder may have it
+  by now.
 - The backend itself reported a state inconsistency.
 
-`onLost` fires **once per loss**.  After it fires, `checkAlive()`
-returns `false` and `acquire()` is needed before regaining
-ownership.
+`onLost` fires **once per loss**.  By then `checkAlive()` already
+returns `false` — on a TTL that ran out, from the deadline on — and
+`acquire()` is needed before regaining ownership.
 
 The handler should **drop ownership state immediately** — stop
 work, release locks, signal interested actors.  Don't await
@@ -210,8 +221,11 @@ flowchart TB
 Same pattern for sharding coordinator:
 
 1. **`lease.acquire`** before processing allocation requests.
-2. **`lease.checkAlive`** before issuing each allocation.
-3. **`onLost`** → reject pending allocations, stop coordinator.
+2. **Its own lease state** gates every allocation: the coordinator
+   acts only while it holds the lease, and `onLost` is what clears
+   that state.
+3. **`onLost`** → step down: cancel in-flight rebalances, drop
+   pending queries, then try to re-acquire while still leader.
 
 ## Writing a custom backend
 
@@ -219,15 +233,18 @@ Same pattern for sharding coordinator:
 import type { Lease, LeaseOptionsType } from 'actor-ts/coordination';
 
 class EtcdLease implements Lease {
-  private alive = false;
+  private held = false;
+  /** When the last write etcd accepted was sent, plus the TTL. */
+  private expiresAt = 0;
   private onLostHandlers = new Set<(reason: string) => void>();
   private renewTimer: NodeJS.Timeout | null = null;
 
   constructor(private readonly settings: LeaseOptionsType & { /* etcd-specific */ }) {}
 
   async acquire(): Promise<boolean> {
-    // Try to atomically CAS the etcd key from empty to this owner.
-    // Start a renewal timer on success.
+    // Read the clock, then try to atomically CAS the etcd key from
+    // empty to this owner.  On success: held = true,
+    // expiresAt = that reading + ttlMs, start a renewal timer.
     // ...
   }
 
@@ -238,7 +255,10 @@ class EtcdLease implements Lease {
   }
 
   checkAlive(): boolean {
-    return this.alive;
+    // Never the flag alone: a stalled event loop keeps the renewal
+    // that would clear it from running, while another owner takes
+    // the key.
+    return this.held && Date.now() < this.expiresAt;
   }
 
   onLost(handler: (reason: string) => void): () => void {
@@ -247,7 +267,7 @@ class EtcdLease implements Lease {
   }
 
   private fireOnLost(reason: string): void {
-    this.alive = false;
+    this.held = false;
     for (const h of this.onLostHandlers) {
       try { h(reason); } catch { /* swallow */ }
     }
@@ -255,16 +275,23 @@ class EtcdLease implements Lease {
 }
 ```
 
-Three things any backend needs to get right:
+Four things any backend needs to get right:
 
 1. **Atomicity on `acquire`** — two concurrent `acquire()` calls
    from different owners must produce one winner.  The backend's
    own consistency model has to provide this (CAS, paxos,
    raft-backed).
 2. **Periodic renewal** — keep the lease alive in the backend.
-   Configurable interval, typically `ttl / 3`.
+   Configurable interval, typically `ttl / 3`.  A renewal that only
+   comes round after the deadline gives the lease up rather than
+   extending the record: another owner may hold it by now.
 3. **`onLost` accuracy** — fire when ownership truly transitions
    away, including the TTL-expiry case.
+4. **`checkAlive` against the deadline** — compare against the
+   expiry of the last write the backend accepted, measured from
+   when it was sent.  A held flag alone stays `true` through
+   exactly the stall that lost the lease, and `LeaseMajority`
+   relies on the answer.
 
 Test the implementation against:
 
@@ -275,26 +302,31 @@ Test the implementation against:
 
 import { Aside } from '@astrojs/starlight/components';
 
-<Aside type="caution" title="`checkAlive` is approximate">
+<Aside type="caution" title="`checkAlive` gates; it doesn't prove">
   ```ts
   if (lease.checkAlive()) {
-    await doWork();   // could complete just after lease was lost
+    await doWork();   // could complete just after the deadline passed
   }
   ```
-  Use `checkAlive` to **gate** work, not as proof of ownership.
-  For irreversible actions (committing to an external service),
-  also pass through a backend roundtrip (acquire-already-held
-  is fast) or rely on `onLost` to stop new work.
+  `checkAlive` is right at the moment it answers, and nothing stops
+  the deadline passing while the work it gated runs.  Use it to
+  **gate** work, not as proof of ownership.  For irreversible
+  actions (committing to an external service), also pass through a
+  backend roundtrip (acquire-already-held is fast) or rely on
+  `onLost` to stop new work.
 </Aside>
 
 <Aside type="caution" title="Don't sleep through TTL">
   ```ts
-  // GC pause longer than ttlMs?  Lease silently lost.
+  // GC pause longer than ttlMs?  The lease is gone.
   ```
   TTL-based leases can't tell the difference between "holder
-  crashed" and "holder paused."  If your process can pause longer
-  than the TTL (large GC, suspended VM), set the TTL longer than
-  your worst-case pause.
+  crashed" and "holder paused."  A holder that pauses past its TTL
+  reads `checkAlive()` as `false` when it resumes, and its first
+  renewal reports the loss through `onLost` instead of extending
+  the lapsed record — another holder may have taken it meanwhile.
+  If your process can pause longer than the TTL (large GC,
+  suspended VM), set the TTL longer than your worst-case pause.
 </Aside>
 
 <Aside type="caution" title="`release` after `onLost` is harmless">
diff --git a/docs/src/content/docs/coordination/overview.mdx b/docs/src/content/docs/coordination/overview.mdx
index d37e26341..715495ccd 100644
--- a/docs/src/content/docs/coordination/overview.mdx
+++ b/docs/src/content/docs/coordination/overview.mdx
@@ -35,7 +35,8 @@ Four methods:
 - **`release()`** — voluntarily drop ownership.  No-op if not
   held.
 - **`checkAlive()`** — cheap, local "do I still own this lease?"
-  check.
+  check.  `true` only until the TTL runs out since the last write
+  the backend accepted, whether or not a renewal has run since.
 - **`onLost(handler)`** — register a callback fired if ownership is
   lost unexpectedly (TTL expired without renewal, another holder
   took over).
@@ -92,7 +93,9 @@ The flow:
 3. While holding, the backend **renews** every `renewalIntervalMs`
    (typically `ttl / 3`).
 4. If renewal fails (network blip, backend down, lease taken
-   over), `onLost` fires with the reason.
+   over) — or only comes round after the TTL already ran out —
+   `onLost` fires with the reason.  From the deadline on,
+   `checkAlive()` already reads `false`.
 5. The actor releases ownership-dependent state immediately.
 
 The TTL is critical — a holder that crashes without `release`
@@ -115,7 +118,7 @@ type LeaseOptionsType = {
 | Setting | Typical values |
 | --- | --- |
 | `ttlMs` | 15-30 s.  Short enough to recover from a crashed holder, long enough to tolerate gossip / renewal delays. |
-| `renewalIntervalMs` | ~`ttl / 3`.  Renew often enough that a single failed renew doesn't lose the lease. |
+| `renewalIntervalMs` | ~`ttl / 3`, the default.  A renewal that only comes round after the TTL ran out gives the lease up, so keep it well under the TTL. |
 | `acquireRetries` | 3-10 for production. |
 | `acquireRetryDelayMs` | 100-1000 ms. |
 
@@ -198,6 +201,12 @@ import { Aside } from '@astrojs/starlight/components';
   backend detail, not a weaker contract — `onLost` still means
   ownership is gone.  `InMemoryLease` has no such distinction to
   draw and drops the lease on the first failure. (#761)
+
+  A renewal that only comes round after the TTL ran out — a
+  stalled event loop, or the previous renewal still hanging on the
+  wire — counts as failed too.  It fires `onLost` and does not
+  extend the lapsed record, because another holder may have taken
+  it meanwhile. (#937)
 </Aside>
 
 ## Where to next
diff --git a/docs/src/content/docs/de/cluster/downing-strategies.mdx b/docs/src/content/docs/de/cluster/downing-strategies.mdx
index adc8fde94..640e2417d 100644
--- a/docs/src/content/docs/de/cluster/downing-strategies.mdx
+++ b/docs/src/content/docs/de/cluster/downing-strategies.mdx
@@ -495,6 +495,34 @@ Das sichtbare Symptom eines Lease-Providers mit einem schlechten
 Tag ist deshalb ein Cluster, der wartet — keiner, der auseinander
 fällt.
 
+### Wenn ein Gewinn seine Lease überdauert
+
+Ein Gewinn ist nur so gut wie die Lease dahinter.  Sobald die
+Sicht `stable-after` lang stabil war, fragt der Cluster die
+Strategie bei jedem Failure-Detector-Tick erneut, sodass ein
+gecachter Gewinn noch lange nach dem Acquire zurückkommen kann, das
+ihn erzeugt hat.  Ein Node, der dazwischen länger als die TTL der
+Lease stand — eine lange GC-Pause, ein ausgehungerter Container —,
+hat die Lease an die andere Seite verloren, die inzwischen *diese*
+herunterfährt.  Den alten Gewinn erneut abzuspielen ist genau der
+Weg, auf dem beide Hälften als Überlebende handeln.
+
+Bevor eine gewonnene Entscheidung erneut zurückgegeben wird, fragt
+die Strategie deshalb `lease.checkAlive()`.  Ist die Lease
+abgelaufen, wird der Gewinn verworfen und die Seite arbitriert neu:
+Das neue Acquire verliert, wenn die andere Seite die Lease jetzt
+hält — dann fährt sich diese Seite selbst herunter —, und gewinnt
+sie zurück, wenn niemand sie genommen hat.  Ein verlorener
+Schiedsspruch wird nicht erneut gestellt; er stützt sich nicht auf
+die Lease.  Das setzt voraus, dass das Backend `checkAlive()`
+gegen seine TTL beantwortet statt aus einem gehaltenen Flag — was
+beide eingebauten Backends tun (#937).
+
+Ein Acquire, das länger als die TTL der Lease dauert, kann nie
+einen verwertbaren Gewinn liefern: Die Strategie arbitriert weiter
+und entscheidet nichts — dieselbe Haltung wie bei einem noch
+laufenden Acquire.
+
 ## Eine Strategie auswählen
 
 Drei Fragen, in dieser Reihenfolge:
diff --git a/docs/src/content/docs/de/coordination/in-memory-lease.mdx b/docs/src/content/docs/de/coordination/in-memory-lease.mdx
index 0318559e4..1d4945f80 100644
--- a/docs/src/content/docs/de/coordination/in-memory-lease.mdx
+++ b/docs/src/content/docs/de/coordination/in-memory-lease.mdx
@@ -104,21 +104,29 @@ Die Implementierung:
 - **`acquire()`** CAS-t den Registry-Slot atomar.  Gibt `true`
   zurück, wenn sie ihn beansprucht hat; `false`, wenn ein
   anderer Owner ihn hält.
-- **TTL-Ablauf** — wenn der Halter nicht innerhalb von `ttlMs`
-  renewt, gibt das Registry automatisch frei (eine
-  setTimeout-getriebene Bereinigung).
-- **`onLost`** feuert, wenn ein anderer Halter übernimmt (via
-  TTL-Ablauf-Mechanismus) oder wenn das Registry forciert geleert
-  wird.
-- **Renewal** läuft auf einem `setInterval` zum
-  `renewalIntervalMs` (Default `ttl / 3`).
-
-`InMemoryLease` nutzt echte Timer (`setInterval`) und bietet keinen
-Scheduler-Injektionspunkt — es gibt keinen `ManualScheduler`, den
-man einhängen könnte.  Für deterministische Lease-Timing-Tests mocke
-`Date.now()`; um geteilten Lease-State zwischen Tests
-zurückzusetzen, leere das exportierte Singleton `inMemoryLeaseStore`
-direkt (`inMemoryLeaseStore._clear()`).
+- **TTL-Ablauf** passiert lazy — zur Deadline läuft nichts.  Ein
+  Record nach seinem Ablauf ist einfach frei: Das nächste
+  `acquire()` eines anderen Owners übernimmt ihn, und
+  `inMemoryLeaseStore.peek()` meldet ihn nicht mehr.
+- **`checkAlive()`** vergleicht gegen denselben Ablauf, sodass ein
+  Halter, dessen Renewal nicht rechtzeitig kam, ab der Deadline
+  `false` liest, bevor ihm irgendetwas davon gesagt hat.
+- **Renewal** läuft alle `renewalIntervalMs` (Default ein Drittel
+  der TTL mit 100 ms Untergrenze, gedeckelt auf die halbe TTL).
+  Ein Renewal, das erst nach der Deadline drankommt, gibt den
+  Lease auf und feuert `onLost`, statt den abgelaufenen Record zu
+  verlängern.
+- **`onLost`** feuert, wenn ein Renewal den Record weg, von einem
+  anderen Owner gehalten oder über seiner Deadline findet —
+  Letzteres sieht ein Halter, der länger als seine TTL stand.
+
+Timer laufen standardmäßig auf `setInterval`.
+`LeaseOptions.withScheduler(...)` legt TTL, Renewal-Takt und
+Acquire-Retries stattdessen auf einen Scheduler — mit einem
+`ManualScheduler` spult ein Test dreißig Sekunden TTL vor, ohne
+darauf zu warten.  Um geteilten Lease-State zwischen Tests
+zurückzusetzen, leere das exportierte Singleton
+`inMemoryLeaseStore` direkt (`inMemoryLeaseStore._clear()`).
 
 ## Beispiel: ein Singleton-Test
 
diff --git a/docs/src/content/docs/de/coordination/kubernetes-lease.mdx b/docs/src/content/docs/de/coordination/kubernetes-lease.mdx
index 72add7453..8a80c9663 100644
--- a/docs/src/content/docs/de/coordination/kubernetes-lease.mdx
+++ b/docs/src/content/docs/de/coordination/kubernetes-lease.mdx
@@ -417,16 +417,26 @@ angenommen werden.
 
 - Ein Renewal-PUT abgelehnt wird **und** der Re-Read eine andere
   `holderIdentity` zeigt — oder gar kein Lease-Objekt mehr.
-- Das Framework feststellt, dass der Lease von jemandem anderem
-  modifiziert wurde (ein Probe-GET vor einer kritischen
-  Operation).
-- Netzwerk-Partition Renewals länger als `ttlMs` verhindert.
-
-**Nicht** feuert es bei einem CAS-Conflict, dessen Re-Read weiterhin
-diesen Owner nennt.  Dann kollidiert der Halter mit einem seiner
-eigenen Writes — ein anderer Controller, der das Objekt anfasst, oder
-ein re-`acquire()`, das mit einem Renewal rennt — und der Record gehört
-weiterhin uns.
+- Ein Renewal-Tick feststellt, dass seit dem Senden des letzten vom
+  API-Server akzeptierten Writes bereits `ttlMs` vergangen sind —
+  die Event-Loop stand, eine Netzwerk-Partition hat Renewals
+  verhindert, oder der vorige Renewal-PUT hängt noch auf der
+  Leitung.  Es wird kein PUT gesendet: Ein anderer Pod hält den
+  Lease womöglich schon (#937).
+- Ein Renewal schlichtweg fehlschlägt (Netzwerkfehler, ein
+  Credential, das der API-Server weiterhin ablehnt).
+
+**Nicht** feuert `onLost` bei einem CAS-Conflict, dessen Re-Read
+weiterhin diesen Owner nennt.  Dann kollidiert der Halter mit einem
+seiner eigenen Writes — ein anderer Controller, der das Objekt
+anfasst, oder ein re-`acquire()`, das mit einem Renewal rennt — und
+der Record gehört weiterhin uns.
+
+`checkAlive()` wird an der TTL-Deadline selbst `false`, ohne auf
+einen Tick zu warten.  Die Deadline wird auf zwei Uhren beurteilt
+und ist vorbei, sobald eine der beiden das sagt: der monotonen,
+die NTP nicht zurückstellen kann, und der Wall-Clock, die die Zeit
+mitzählt, die ein suspendierter Host verloren hat.
 
 Der Handler sollte den eigentumsabhängigen State sofort fallen
 lassen — siehe [Lease-API](/de/coordination/lease-api/) für den
diff --git a/docs/src/content/docs/de/coordination/lease-api.mdx b/docs/src/content/docs/de/coordination/lease-api.mdx
index 0013d6505..23cb3db10 100644
--- a/docs/src/content/docs/de/coordination/lease-api.mdx
+++ b/docs/src/content/docs/de/coordination/lease-api.mdx
@@ -143,22 +143,31 @@ if (lease.checkAlive()) {
 ```
 
 Ein **synchroner, lokaler** Check.  Kein Netzwerk-Roundtrip.
-Gibt den jüngsten Wissensstand des Halters zurück: "Halte ich
-das noch?"
-
-Vom Framework genutzt, um eigentumsabhängige Arbeit zu gaten —
-z. B. ruft der Koordinator vor dem Vergeben einer Shard-Allocation
-`checkAlive()` und bricht ab, wenn `false` zurückkommt.
-
-Implementierungen tracken Eigentum lokal; die Renewal-Schleife
-des Backends aktualisiert das lokale Flag.  Das heißt,
-`checkAlive()` spiegelt **bis zu einem verpassten Renewal an
-Veraltung** wider — ein Sub-Sekunden-Fenster, in dem der Lease
-tatsächlich weg sein könnte, `checkAlive()` aber noch `true`
-liefert.
-
-Für absolute Gewissheit nimm `onLost(...)` und reagiere auf die
-Benachrichtigung, statt zu pollen.
+Gibt `true` zurück, solange dieser Prozess den Lease hält **und**
+seine TTL nicht abgelaufen ist — gemessen ab dem Zeitpunkt, zu dem
+der letzte vom Backend akzeptierte Write *gesendet* wurde.  So
+liegt die lokale Deadline nie später als die, nach der andere
+Halter den Record beurteilen.
+
+Die Antwort stützt sich auf diese Deadline, nicht auf ein Flag.
+Ein Flag wird nur von einem Renewal gelöscht, das den Verlust
+bemerkt, und eine blockierte Event-Loop — eine GC-Pause, ein
+ausgehungerter Container — ist genau das, was dieses Renewal am
+Laufen hindert, während ein anderer Halter den Lease in der
+Zwischenzeit legitim übernehmen kann.  Deshalb wird
+`checkAlive()` an der Deadline selbst `false`, bevor `onLost`
+überhaupt feuern konnte (#937).
+
+`LeaseMajority` prüft damit einen gewonnenen Schiedsspruch erneut,
+bevor es wieder darauf handelt.  Singleton Manager,
+Sharding-Koordinator und Persistence-Fencing reagieren
+stattdessen auf `onLost`.
+
+Die beiden antworten zu unterschiedlichen Zeitpunkten.
+`checkAlive()` wird an der Deadline `false`; `onLost(...)` feuert
+beim ersten Renewal danach, bis zu ein Renewal-Intervall später.
+Gate jedes einzelne Stück Arbeit mit `checkAlive()`, und registriere
+`onLost(...)`, um laufende Arbeit zu stoppen, statt zu pollen.
 
 ## `onLost(handler): () => void`
 
@@ -177,12 +186,16 @@ Registriere einen Callback, der feuert, wenn das Eigentum
 - Das Backend hat gemeldet, der Lease wurde von einem anderen
   Halter übernommen.
 - Die TTL ist ohne erfolgreiches Renewal abgelaufen (z. B.
-  Netzwerk-Partition).
+  Netzwerk-Partition oder eine blockierte Event-Loop).  Der erste
+  Renewal-Tick nach der Deadline meldet das und gibt den Lease
+  auf, statt den abgelaufenen Record zu verlängern — ein anderer
+  Halter hat ihn womöglich schon.
 - Das Backend selbst hat eine Zustands-Inkonsistenz gemeldet.
 
-`onLost` feuert **einmal pro Verlust**.  Danach gibt
-`checkAlive()` `false` zurück, und `acquire()` ist nötig, um das
-Eigentum zurückzugewinnen.
+`onLost` feuert **einmal pro Verlust**.  Bis dahin gibt
+`checkAlive()` bereits `false` zurück — bei abgelaufener TTL ab
+der Deadline —, und `acquire()` ist nötig, um das Eigentum
+zurückzugewinnen.
 
 Der Handler sollte **State, der vom Eigentum abhängt, sofort
 fallen lassen** — Arbeit stoppen, Locks freigeben, interessierte
@@ -227,9 +240,12 @@ flowchart TB
 Gleiches Muster für den Sharding-Koordinator:
 
 1. **`lease.acquire`** vor Verarbeitung von Allocation-Anfragen.
-2. **`lease.checkAlive`** vor dem Vergeben jeder Allocation.
-3. **`onLost`** → ausstehende Allocations ablehnen, Koordinator
-   stoppen.
+2. **Der eigene Lease-Zustand** gated jede Allocation: Der
+   Koordinator handelt nur, solange er den Lease hält, und `onLost`
+   ist das, was diesen Zustand löscht.
+3. **`onLost`** → zurücktreten: laufende Rebalances abbrechen,
+   ausstehende Anfragen verwerfen, dann erneut acquiren, solange
+   er noch Leader ist.
 
 ## Ein eigenes Backend schreiben
 
@@ -237,15 +253,18 @@ Gleiches Muster für den Sharding-Koordinator:
 import type { Lease, LeaseOptionsType } from 'actor-ts/coordination';
 
 class EtcdLease implements Lease {
-  private alive = false;
+  private held = false;
+  /** Wann der letzte von etcd akzeptierte Write gesendet wurde, plus TTL. */
+  private expiresAt = 0;
   private onLostHandlers = new Set<(reason: string) => void>();
   private renewTimer: NodeJS.Timeout | null = null;
 
   constructor(private readonly settings: LeaseOptionsType & { /* etcd-spezifisch */ }) {}
 
   async acquire(): Promise<boolean> {
-    // Versuche, den etcd-Key atomar von leer auf diesen Owner zu CAS-en.
-    // Starte bei Erfolg einen Renewal-Timer.
+    // Uhr lesen, dann versuchen, den etcd-Key atomar von leer auf
+    // diesen Owner zu CAS-en.  Bei Erfolg: held = true,
+    // expiresAt = dieser Messwert + ttlMs, Renewal-Timer starten.
     // ...
   }
 
@@ -256,7 +275,10 @@ class EtcdLease implements Lease {
   }
 
   checkAlive(): boolean {
-    return this.alive;
+    // Nie das Flag allein: Eine blockierte Event-Loop hält genau
+    // das Renewal auf, das es löschen würde, während ein anderer
+    // Owner den Key übernimmt.
+    return this.held && Date.now() < this.expiresAt;
   }
 
   onLost(handler: (reason: string) => void): () => void {
@@ -265,7 +287,7 @@ class EtcdLease implements Lease {
   }
 
   private fireOnLost(reason: string): void {
-    this.alive = false;
+    this.held = false;
     for (const h of this.onLostHandlers) {
       try { h(reason); } catch { /* schlucken */ }
     }
@@ -273,7 +295,7 @@ class EtcdLease implements Lease {
 }
 ```
 
-Drei Dinge, die jedes Backend richtig hinkriegen muss:
+Vier Dinge, die jedes Backend richtig hinkriegen muss:
 
 1. **Atomarität bei `acquire`** — zwei nebenläufige `acquire()`-Aufrufe
    verschiedener Owner müssen genau einen Gewinner produzieren.
@@ -281,8 +303,16 @@ Drei Dinge, die jedes Backend richtig hinkriegen muss:
    Paxos, Raft-backed).
 2. **Periodisches Renewal** — den Lease im Backend am Leben
    halten.  Konfigurierbares Intervall, typischerweise `ttl / 3`.
+   Ein Renewal, das erst nach der Deadline drankommt, gibt den
+   Lease auf, statt den Record zu verlängern: Ein anderer Owner
+   hält ihn womöglich schon.
 3. **`onLost`-Genauigkeit** — feuern, wenn das Eigentum
    tatsächlich übergeht, inklusive des TTL-Ablauf-Falls.
+4. **`checkAlive` gegen die Deadline** — gegen den Ablauf des
+   letzten vom Backend akzeptierten Writes vergleichen, gemessen
+   ab dessen Senden.  Ein gehaltenes Flag allein bleibt genau
+   durch den Stall hindurch `true`, der den Lease gekostet hat,
+   und `LeaseMajority` verlässt sich auf die Antwort.
 
 Teste die Implementierung gegen:
 
@@ -293,27 +323,34 @@ Teste die Implementierung gegen:
 
 import { Aside } from '@astrojs/starlight/components';
 
-<Aside type="caution" title="`checkAlive` ist approximativ">
+<Aside type="caution" title="`checkAlive` gated, beweist aber nichts">
   ```ts
   if (lease.checkAlive()) {
-    await doWork();   // könnte direkt nachdem der Lease verloren ging fertig werden
+    await doWork();   // könnte direkt nach Ablauf der Deadline fertig werden
   }
   ```
-  Nutze `checkAlive`, um Arbeit zu **gaten**, nicht als Beweis
-  des Eigentums.  Für unwiderrufliche Aktionen (Commit zu einem
-  externen Service) auch einen Backend-Roundtrip nehmen
+  `checkAlive` stimmt im Moment der Antwort, und nichts hindert die
+  Deadline daran, abzulaufen, während die damit gegatete Arbeit
+  läuft.  Nutze `checkAlive`, um Arbeit zu **gaten**, nicht als
+  Beweis des Eigentums.  Für unwiderrufliche Aktionen (Commit zu
+  einem externen Service) auch einen Backend-Roundtrip nehmen
   (Acquire-bereits-gehalten ist schnell) oder auf `onLost`
   vertrauen, um neue Arbeit zu stoppen.
 </Aside>
 
 <Aside type="caution" title="Nicht durch die TTL schlafen">
   ```ts
-  // GC-Pause länger als ttlMs? Lease still verloren.
+  // GC-Pause länger als ttlMs? Der Lease ist weg.
   ```
   TTL-basierte Leases können nicht zwischen "Halter abgestürzt"
-  und "Halter pausiert" unterscheiden.  Wenn dein Prozess länger
-  als die TTL pausieren kann (große GC, suspendierte VM), setz
-  die TTL länger als deine Worst-Case-Pause.
+  und "Halter pausiert" unterscheiden.  Ein Halter, der länger als
+  seine TTL pausiert, liest `checkAlive()` beim Aufwachen als
+  `false`, und sein erstes Renewal meldet den Verlust über
+  `onLost`, statt den abgelaufenen Record zu verlängern — ein
+  anderer Halter hat ihn womöglich inzwischen übernommen.  Wenn
+  dein Prozess länger als die TTL pausieren kann (große GC,
+  suspendierte VM), setz die TTL länger als deine
+  Worst-Case-Pause.
 </Aside>
 
 <Aside type="caution" title="`release` nach `onLost` ist harmlos">
diff --git a/docs/src/content/docs/de/coordination/overview.mdx b/docs/src/content/docs/de/coordination/overview.mdx
index ef4680909..e8935b2c1 100644
--- a/docs/src/content/docs/de/coordination/overview.mdx
+++ b/docs/src/content/docs/de/coordination/overview.mdx
@@ -36,7 +36,9 @@ Vier Methoden:
 - **`release()`** — gib das Eigentum freiwillig ab.  No-op, wenn
   nicht gehalten.
 - **`checkAlive()`** — billiger, lokaler "halte ich diesen Lease
-  noch?"-Check.
+  noch?"-Check.  `true` nur, bis die TTL seit dem letzten vom
+  Backend akzeptierten Write abgelaufen ist, ob seither ein
+  Renewal lief oder nicht.
 - **`onLost(handler)`** — Registriere einen Callback, der feuert, wenn
   das Eigentum unerwartet verloren geht (TTL ohne Renewal
   abgelaufen, ein anderer Halter hat übernommen).
@@ -97,7 +99,9 @@ Der Ablauf:
 3. Während gehalten, **renewt** das Backend alle
    `renewalIntervalMs` (typischerweise `ttl / 3`).
 4. Wenn das Renewal fehlschlägt (Netz-Hänger, Backend down, Lease
-   übernommen), feuert `onLost` mit dem Grund.
+   übernommen) — oder erst drankommt, nachdem die TTL schon
+   abgelaufen ist —, feuert `onLost` mit dem Grund.  Ab der
+   Deadline liest `checkAlive()` bereits `false`.
 5. Der Actor gibt eigentumsabhängigen State sofort frei.
 
 Die TTL ist kritisch — ein Halter, der ohne `release` abstürzt,
@@ -120,7 +124,7 @@ type LeaseOptionsType = {
 | Setting | Typische Werte |
 | --- | --- |
 | `ttlMs` | 15-30 s.  Kurz genug, um von einem abgestürzten Halter zu erholen, lang genug, um Gossip-/Renewal-Verzögerungen zu tolerieren. |
-| `renewalIntervalMs` | ~`ttl / 3`.  Oft genug renewen, dass ein einzelnes fehlgeschlagenes Renew den Lease nicht verliert. |
+| `renewalIntervalMs` | ~`ttl / 3`, der Default.  Ein Renewal, das erst nach Ablauf der TTL drankommt, gibt den Lease auf — halte das Intervall also deutlich unter der TTL. |
 | `acquireRetries` | 3-10 für Produktion. |
 | `acquireRetryDelayMs` | 100-1000 ms. |
 
@@ -209,6 +213,12 @@ import { Aside } from '@astrojs/starlight/components';
   der Besitz weg ist.  `InMemoryLease` hat diese Unterscheidung
   gar nicht zu treffen und verliert den Lease beim ersten
   Fehlschlag. (#761)
+
+  Ein Renewal, das erst nach Ablauf der TTL drankommt — eine
+  blockierte Event-Loop oder das vorige Renewal, das noch auf der
+  Leitung hängt —, zählt ebenfalls als fehlgeschlagen.  Es feuert
+  `onLost` und verlängert den abgelaufenen Record nicht, weil ihn
+  ein anderer Halter inzwischen übernommen haben kann. (#937)
 </Aside>
 
 ## Wohin als Nächstes
diff --git a/docs/src/content/docs/de/reference/configuration.mdx b/docs/src/content/docs/de/reference/configuration.mdx
index a63862502..ed1915f44 100644
--- a/docs/src/content/docs/de/reference/configuration.mdx
+++ b/docs/src/content/docs/de/reference/configuration.mdx
@@ -743,7 +743,7 @@ spätere Aufrufer aus, die dem Cap selbst nie nahe kamen.
 | Key | Default | Zweck |
 | --- | --- | --- |
 | `coordination.lease.ttl` | *(ungesetzt)* | Lease-TTL für das gesamte Deployment.  Liefert **kein Leaf** aus — ein Wert hier würde `ttlMs` für jeden Lease im Prozess setzen und die Prüfung „`ttlMs` ist Pflicht" unerreichbar machen. |
-| `coordination.lease.renewal-interval` | *(ungesetzt)* | Wie oft ein gehaltener Lease erneuert wird.  Liefert **kein Leaf** aus — ungesetzt wählt das berechnete `max(500ms, ttl/3)`, und `0` kann nicht „leite es ab" heißen, weil der Validator es ablehnt. |
+| `coordination.lease.renewal-interval` | *(ungesetzt)* | Wie oft ein gehaltener Lease erneuert wird.  Liefert **kein Leaf** aus — ungesetzt wählt ein Drittel der TTL mit Untergrenze (100 ms In-Memory, 500 ms Kubernetes), gedeckelt auf die halbe TTL, damit ein Renewal immer vor dem Ablauf des Records drankommt, und `0` kann nicht „leite es ab" heißen, weil der Validator es ablehnt. |
 | `coordination.lease.kubernetes.namespace` | *(ungesetzt)* | Namespace, in dem das `Lease`-Objekt liegt.  Liefert **kein Leaf** aus — ungesetzt heißt „lies `namespace-path` aus dem ServiceAccount-Mount des Pods", und `""` wird abgelehnt. |
 | `coordination.lease.kubernetes.namespace-path` | `"/var/run/secrets/kubernetes.io/serviceaccount/namespace"` | Datei, aus der der Namespace des Pods gelesen wird. |
 | `coordination.lease.kubernetes.token-path` | `"/var/run/secrets/kubernetes.io/serviceaccount/token"` | Datei, aus der das Bearer-Token gelesen wird.  Ein **Pfad**, niemals das Token. |
diff --git a/docs/src/content/docs/de/reference/reference-conf.mdx b/docs/src/content/docs/de/reference/reference-conf.mdx
index a68d86237..3bfba8ec6 100644
--- a/docs/src/content/docs/de/reference/reference-conf.mdx
+++ b/docs/src/content/docs/de/reference/reference-conf.mdx
@@ -1120,8 +1120,9 @@ actor-ts {
       #
       #   ttl = 30s
       #
-      # renewal-interval -- deliberately unset as well.  Unset selects
-      # max(500ms, ttl/3), which is the computed default both backends want,
+      # renewal-interval -- deliberately unset as well.  Unset selects a third
+      # of the TTL with a floor (100ms in-memory, 500ms Kubernetes), capped at
+      # half the TTL so a renewal always comes round before the record lapses,
       # and the validator rejects 0, so a "0 means derive it" sentinel is not
       # expressible:
       #
diff --git a/docs/src/content/docs/reference/configuration.mdx b/docs/src/content/docs/reference/configuration.mdx
index 83c2dcb61..b64e37677 100644
--- a/docs/src/content/docs/reference/configuration.mdx
+++ b/docs/src/content/docs/reference/configuration.mdx
@@ -700,7 +700,7 @@ never came near the cap themselves.
 | Key | Default | Purpose |
 | --- | --- | --- |
 | `coordination.lease.ttl` | *(unset)* | Lease TTL for the whole deployment. Ships **no leaf** — a value here would supply `ttlMs` for every lease in the process and make the "`ttlMs` is required" guard unreachable. |
-| `coordination.lease.renewal-interval` | *(unset)* | How often a held lease is renewed. Ships **no leaf** — unset selects the computed `max(500ms, ttl/3)`, and `0` cannot mean "derive it" because the validator rejects it. |
+| `coordination.lease.renewal-interval` | *(unset)* | How often a held lease is renewed. Ships **no leaf** — unset selects a third of the TTL with a floor (100 ms in-memory, 500 ms Kubernetes), capped at half the TTL so a renewal always comes round before the record lapses, and `0` cannot mean "derive it" because the validator rejects it. |
 | `coordination.lease.kubernetes.namespace` | *(unset)* | Namespace holding the `Lease` object. Ships **no leaf** — unset means "read `namespace-path` from the Pod's ServiceAccount mount", and `""` is rejected. |
 | `coordination.lease.kubernetes.namespace-path` | `"/var/run/secrets/kubernetes.io/serviceaccount/namespace"` | File the Pod's namespace is read from. |
 | `coordination.lease.kubernetes.token-path` | `"/var/run/secrets/kubernetes.io/serviceaccount/token"` | File the bearer token is read from. A **path**, never the token. |
diff --git a/docs/src/content/docs/reference/reference-conf.mdx b/docs/src/content/docs/reference/reference-conf.mdx
index 78a81d8a9..a71da0bf8 100644
--- a/docs/src/content/docs/reference/reference-conf.mdx
+++ b/docs/src/content/docs/reference/reference-conf.mdx
@@ -1119,8 +1119,9 @@ actor-ts {
       #
       #   ttl = 30s
       #
-      # renewal-interval -- deliberately unset as well.  Unset selects
-      # max(500ms, ttl/3), which is the computed default both backends want,
+      # renewal-interval -- deliberately unset as well.  Unset selects a third
+      # of the TTL with a floor (100ms in-memory, 500ms Kubernetes), capped at
+      # half the TTL so a renewal always comes round before the record lapses,
       # and the validator rejects 0, so a "0 means derive it" sentinel is not
       # expressible:
       #
diff --git a/src/cluster/downing/LeaseMajority.ts b/src/cluster/downing/LeaseMajority.ts
index d3bd4a4e7..24dc02538 100644
--- a/src/cluster/downing/LeaseMajority.ts
+++ b/src/cluster/downing/LeaseMajority.ts
@@ -73,6 +73,25 @@ import type { LeaseMajorityOptions, LeaseMajorityOptionsType } from './LeaseMajo
  *     view returns an empty decision, refusing to claim majority
  *     until the partition heals (which resets the fail-safe flag).
  *
+ * **Re-validated win (#937)**
+ *
+ * A won arbitration is only true for as long as the lease behind it is.
+ * The cached `surviveSet` can be asked for again long after it was
+ * computed — `Cluster` consults the strategy every failure-detector tick
+ * once its stability window opens, and its view moves on things this
+ * strategy's fingerprint ignores — and a holder that stalled past the
+ * TTL in between has had the lease taken by the other side, which is now
+ * downing *this* one.  Replaying the cached "down them" is how both
+ * halves came to act as the survivor.  So a cached win is returned only
+ * while `lease.checkAlive()` says the lease is still held; otherwise it
+ * is dropped and arbitrated afresh.  The fresh acquire loses if the
+ * other side holds the lease now, and wins it back if nobody took it.  A
+ * lost arbitration is not re-asked — it does not rest on the lease.
+ *
+ * An acquire that takes longer than the lease's TTL can therefore never
+ * produce a usable win: the strategy keeps arbitrating and returns no
+ * decision, which is the same conservative posture as a pending acquire.
+ *
  * **Fencing tokens (optional)**
  *
  * If the underlying `Lease` implements `acquireWithToken()` (K8s
@@ -89,6 +108,13 @@ export class LeaseMajority implements DowningProvider {
    *  partition view so a new split triggers a new acquire. */
   private decision: DowningDecision | null = null;
 
+  /**
+   * True when {@link decision} is a won arbitration — the one cached answer
+   * that holds only for as long as the lease does (#937).  Set wherever
+   * `decision` is, so a cached answer never carries a stale flag.
+   */
+  private decisionRestsOnLease = false;
+
   /** True while an `acquire()` is in flight. */
   private acquiring = false;
 
@@ -170,11 +196,13 @@ export class LeaseMajority implements DowningProvider {
     // Strict majority — no Lease needed.
     if (reachable.length >= needed) {
       this.decision = new Set(unreachable.map(addrKey));
+      this.decisionRestsOnLease = false;
       return this.decision;
     }
     // Strict minority — also no Lease needed.
     if (unreachable.length >= needed) {
       this.decision = new Set(reachable.map(addrKey));
+      this.decisionRestsOnLease = false;
       return this.decision;
     }
 
@@ -192,8 +220,14 @@ export class LeaseMajority implements DowningProvider {
     }
 
     if (this.decision !== null) {
-      // Cached from a prior tick on this same view.
-      return this.decision;
+      // Cached from a prior tick on this same view.  A won arbitration is
+      // returned only while the lease behind it is still held (#937);
+      // otherwise it is dropped here and the kickoff below arbitrates afresh.
+      if (!this.decisionRestsOnLease || this.options.lease.checkAlive()) {
+        return this.decision;
+      }
+      this.decision = null;
+      this.decisionRestsOnLease = false;
     }
 
     if (this.acquiring) {
@@ -291,6 +325,7 @@ export class LeaseMajority implements DowningProvider {
     }
     this.acquiring = false;
     this.decision = won ? surviveSet : downSelfSet;
+    this.decisionRestsOnLease = won;
   }
 
   /**
@@ -328,6 +363,7 @@ export class LeaseMajority implements DowningProvider {
 
   private reset(): void {
     this.decision = null;
+    this.decisionRestsOnLease = false;
     this.lastFingerprint = null;
     this.failSafe = false;
     // An acquire that is still in flight loses its watcher here exactly as
diff --git a/src/config/ConfigKeys.ts b/src/config/ConfigKeys.ts
index acec7a975..8ab59850d 100644
--- a/src/config/ConfigKeys.ts
+++ b/src/config/ConfigKeys.ts
@@ -1514,7 +1514,8 @@ export const ConfigKeys = {
    * until an operator sets one. Each is a field the code either requires or
    * derives: a shipped `ttl` would satisfy `validateRequired` for every lease
    * in the process and make the #596 guard unreachable; a shipped
-   * `renewal-interval` would displace the computed `max(500ms, ttl/3)`, and `0`
+   * `renewal-interval` would displace the computed default (a third of the TTL
+   * with each backend's floor, capped at half the TTL), and `0`
    * cannot stand in for "derive it" because the validator rejects it; a shipped
    * `namespace` could only be `""`, which the validator rejects too, and would
    * take away "read it from the Pod's ServiceAccount mount". They are still
diff --git a/src/config/Reference.ts b/src/config/Reference.ts
index da0938867..8fd18f154 100644
--- a/src/config/Reference.ts
+++ b/src/config/Reference.ts
@@ -1100,8 +1100,9 @@ actor-ts {
       #
       #   ttl = 30s
       #
-      # renewal-interval -- deliberately unset as well.  Unset selects
-      # max(500ms, ttl/3), which is the computed default both backends want,
+      # renewal-interval -- deliberately unset as well.  Unset selects a third
+      # of the TTL with a floor (100ms in-memory, 500ms Kubernetes), capped at
+      # half the TTL so a renewal always comes round before the record lapses,
       # and the validator rejects 0, so a "0 means derive it" sentinel is not
       # expressible:
       #
diff --git a/src/coordination/Lease.ts b/src/coordination/Lease.ts
index 53ee5da58..ce879f3e7 100644
--- a/src/coordination/Lease.ts
+++ b/src/coordination/Lease.ts
@@ -5,8 +5,8 @@
  * Four-method contract:
  *   - `acquire()` tries to claim the lease; returns true on success.
  *   - `release()` voluntarily drops ownership.
- *   - `checkAlive()` is a cheap "do I still own this lease?" check used by
- *     failure-detection logic.
+ *   - `checkAlive()` is a cheap "do I still own this lease?" check —
+ *     `LeaseMajority` re-validates a won arbitration with it.
  *   - `onLost(handler)` registers a callback fired if ownership is lost
  *     unexpectedly (TTL expired, another holder took over, etc.).
  *
@@ -60,9 +60,26 @@ export interface Lease {
    */
   release(): Promise<void>;
 
-  /** True if this process currently owns the lease.  Purely local — no IO. */
+  /**
+   * True while this process holds the lease **and** its TTL — measured from
+   * when the last write the backend accepted was *sent* — has not run out.
+   * Purely local — no IO.
+   *
+   * A held flag alone is not an answer (#937).  The flag is only cleared by a
+   * renewal that notices the loss, and a stalled event loop — a GC pause, a
+   * starved container — is exactly what keeps that renewal from running, while
+   * another holder may legitimately take the lease in the meantime.  So the
+   * answer turns false at the deadline, whether or not `onLost` has fired yet.
+   * Measuring from the moment the write was sent rather than answered keeps
+   * the local deadline no later than the one other holders judge the record
+   * by.
+   */
   checkAlive(): boolean;
 
-  /** Register a handler fired when ownership is lost unexpectedly. */
+  /**
+   * Register a handler fired when ownership is lost unexpectedly — including a
+   * TTL that ran out, which the first renewal tick after the deadline reports
+   * instead of extending the lapsed record.
+   */
   onLost(handler: (reason: string) => void): () => void;
 }
diff --git a/src/coordination/LeaseOptions.ts b/src/coordination/LeaseOptions.ts
index 128f7ad31..8e0165c81 100644
--- a/src/coordination/LeaseOptions.ts
+++ b/src/coordination/LeaseOptions.ts
@@ -207,8 +207,9 @@ export type LeaseConfigDefaults = Partial<Pick<LeaseOptionsType, 'ttlMs' | 'rene
  *
  * Neither key ships a leaf in `reference.conf`, so both `hasPath` checks are
  * false until an operator sets one — which is what keeps `ttlMs is required`
- * (#596) reachable and keeps an unset `renewal-interval` meaning "derive
- * `max(500ms, ttl/3)`" rather than "0".
+ * (#596) reachable and keeps an unset `renewal-interval` meaning "derive it"
+ * — a third of the TTL with each backend's floor, capped at half the TTL —
+ * rather than "0".
  */
 export function readLeaseOptionsFromConfig(config: Config = Config.load()): LeaseConfigDefaults {
   const keys = ConfigKeys.coordination.lease;
diff --git a/src/coordination/leases/InMemoryLease.ts b/src/coordination/leases/InMemoryLease.ts
index db24a47f6..9070a556d 100644
--- a/src/coordination/leases/InMemoryLease.ts
+++ b/src/coordination/leases/InMemoryLease.ts
@@ -34,9 +34,18 @@ class InMemoryLeaseStore {
     return version;
   }
 
-  renew(name: string, owner: string, expiresAt: number): boolean {
+  /**
+   * Extend `owner`'s record named `name` to `expiresAt`.  False when the record
+   * is gone, belongs to someone else, or has already lapsed at `now`.
+   *
+   * The lapse check is the half that matters (#937): a lapsed record is free for
+   * any other owner to take, so extending it would hand it back to a holder that
+   * could not keep it — after a stall longer than the TTL, the one case renewal
+   * exists to catch.  `now` is the caller's clock reading, as in {@link tryAcquire}.
+   */
+  renew(name: string, owner: string, expiresAt: number, now: number): boolean {
     const existing = this.leases.get(name);
-    if (!existing || existing.owner !== owner) return false;
+    if (!existing || existing.owner !== owner || existing.expiresAt <= now) return false;
     existing.expiresAt = expiresAt;
     return true;
   }
@@ -81,6 +90,14 @@ export class InMemoryLease implements Lease {
   /** The same object when one was given, `null` when none was — see {@link clock}. */
   private readonly scheduler: Scheduler | null;
   private held = false;
+  /**
+   * When the record this holder last wrote runs out, on {@link clock}.
+   *
+   * `checkAlive()` compares against it rather than trusting {@link held} alone
+   * (#937): `held` is only cleared by a renewal that notices the loss, and a
+   * stalled event loop is precisely what keeps that renewal from running.
+   */
+  private expiresAt = 0;
   private readonly onLostHandlers = new Set<(reason: string) => void>();
 
   private readonly options: LeaseOptionsType;
@@ -97,7 +114,14 @@ export class InMemoryLease implements Lease {
     const validator = new LeaseOptionsValidator();
     validator.validateRequired(this.options);
     validator.validate(this.options);
-    this.renewalIntervalMs = this.options.renewalIntervalMs ?? Math.max(100, Math.floor(this.options.ttlMs / 3));
+    // A third of the TTL with a 100 ms floor, and never more than half of it: a
+    // renewal that only comes round after the record lapsed gives the lease up
+    // (#937), so the floor alone would lose any TTL of 100 ms or less on its
+    // first tick.  An interval set explicitly is taken as given.
+    this.renewalIntervalMs = this.options.renewalIntervalMs ?? Math.max(
+      1,
+      Math.min(Math.max(100, Math.floor(this.options.ttlMs / 3)), Math.floor(this.options.ttlMs / 2)),
+    );
     this.scheduler = this.options.scheduler ?? null;
     this.clock = this.scheduler ?? systemClock;
   }
@@ -123,6 +147,7 @@ export class InMemoryLease implements Lease {
       );
       if (version > 0) {
         this.held = true;
+        this.expiresAt = expiresAt;
         this.startRenewalLoop();
         return { token: `${this.options.name}@v${version}` };
       }
@@ -138,25 +163,44 @@ export class InMemoryLease implements Lease {
     inMemoryLeaseStore.release(this.options.name, this.options.owner);
   }
 
-  checkAlive(): boolean { return this.held; }
+  /**
+   * Held, and the record this holder last wrote has not run out.  Turns false
+   * at the deadline itself — the instant the store lets another owner in —
+   * whether or not a renewal has run since to notice (#937).
+   */
+  checkAlive(): boolean { return this.held && this.clock.now() < this.expiresAt; }
 
   onLost(handler: (reason: string) => void): () => void {
     this.onLostHandlers.add(handler);
     return () => this.onLostHandlers.delete(handler);
   }
 
+  /**
+   * Arm the renewal loop — once.  A re-`acquire()` on a lease this instance
+   * already holds keeps the loop it has: arming a second would overwrite the
+   * handle and leave the first armed for good — past `release()`, where it
+   * fires on nothing but keeps a real-timer process alive, and renewing again
+   * beside the second loop after the next acquire.  `LeaseMajority`
+   * re-acquires exactly like that, since it never releases a lease it won.
+   */
   private startRenewalLoop(): void {
+    if (this.renewalTimer !== null) return;
     const renew = (): void => {
       if (!this.held) return;
-      const ok = inMemoryLeaseStore.renew(
-        this.options.name, this.options.owner, this.clock.now() + this.options.ttlMs,
-      );
-      if (ok) return;
-      this.held = false;
-      this.stopRenewalLoop();
-      for (const handler of this.onLostHandlers) {
-        try { handler('lease lost during renewal'); } catch { /* swallow */ }
+      const now = this.clock.now();
+      // A renewal that comes round after the deadline has nothing left to renew:
+      // the record lapsed while this holder was not looking, and another owner
+      // may already hold it (#937).
+      if (now >= this.expiresAt) {
+        this.lose(`lease expired before it could be renewed (${now - this.expiresAt} ms past its deadline)`);
+        return;
       }
+      const expiresAt = now + this.options.ttlMs;
+      if (inMemoryLeaseStore.renew(this.options.name, this.options.owner, expiresAt, now)) {
+        this.expiresAt = expiresAt;
+        return;
+      }
+      this.lose('lease lost during renewal');
     };
     this.renewalTimer = this.scheduler === null
       ? setInterval(renew, this.renewalIntervalMs)
@@ -165,6 +209,15 @@ export class InMemoryLease implements Lease {
       );
   }
 
+  /** Give the lease up and tell every `onLost` handler why. */
+  private lose(reason: string): void {
+    this.held = false;
+    this.stopRenewalLoop();
+    for (const handler of this.onLostHandlers) {
+      try { handler(reason); } catch { /* swallow */ }
+    }
+  }
+
   /** Disarm whichever kind of handle {@link startRenewalLoop} produced. */
   private stopRenewalLoop(): void {
     if (this.renewalTimer === null) return;
diff --git a/src/coordination/leases/KubernetesLease.ts b/src/coordination/leases/KubernetesLease.ts
index 952f212c9..cabe10538 100644
--- a/src/coordination/leases/KubernetesLease.ts
+++ b/src/coordination/leases/KubernetesLease.ts
@@ -1,3 +1,4 @@
+import { systemClock } from '../../Clock.js';
 import type { Cancellable, Scheduler } from '../../Scheduler.js';
 import type { Lease } from '../Lease.js';
 import {
@@ -55,6 +56,25 @@ type InClusterCredentials = {
 /** Either credential source, tagged with which one it is. */
 type ResolvedCredentials = ExplicitCredentials | InClusterCredentials;
 
+/**
+ * One moment, read off two clocks.  The TTL is judged on both and runs out as
+ * soon as either says so — see {@link KubernetesLease.checkAlive}.
+ */
+type Instant = {
+  /** `performance.now()`: only moves forwards, so an NTP step cannot stretch a TTL measured on it. */
+  readonly monotonic: number;
+  /**
+   * The wall clock: the one the record's `renewTime` is written in, and the one
+   * that still counts the time a suspended host lost — the monotonic clock
+   * stops along with the host.
+   */
+  readonly wall: number;
+};
+
+function instantNow(): Instant {
+  return { monotonic: performance.now(), wall: systemClock.now() };
+}
+
 /**
  * True for the two statuses that reject the **credential** rather than the
  * request.  Read off `K8sLeaseError.response` here rather than special-cased
@@ -96,7 +116,8 @@ function isCredentialRejection(error: unknown): boolean {
  *      live conflict.  Optimistic-write 409 conflicts are retried up to
  *      `acquireRetries` times.
  *
- *   2. **renewal loop** — every `renewalIntervalMs` (default `ttl/3`),
+ *   2. **renewal loop** — every `renewalIntervalMs` (default a third of
+ *      the TTL with a 500 ms floor, capped at half the TTL),
  *      PUT a bumped `renewTime`.  At most one renewal PUT is ever
  *      outstanding, and a rejected one is re-read before ownership is
  *      given up (#761), so only a *foreign* holder, a deleted object or
@@ -114,6 +135,10 @@ function isCredentialRejection(error: unknown): boolean {
  * and immediately on a 401/403.  See {@link resolveCredentials}.
  *
  * Failure modes that fire `onLost`:
+ *   - A renewal tick that finds the TTL already run out since the last
+ *     write the API server accepted was sent — the event loop stalled, or
+ *     the previous renewal PUT is still hanging on the wire.  No PUT is
+ *     sent: another pod may hold the lease by now (#937).
  *   - A rejected renewal PUT whose re-read shows a different
  *     `holderIdentity` — someone else won a race after we read the
  *     resourceVersion.
@@ -141,6 +166,8 @@ export class KubernetesLease implements Lease {
    * Only the cadence.  A `KubernetesLease` talks to a real API server, so its
    * requests, their timeouts and the token reload interval stay on real time —
    * virtualizing those would mean pretending an HTTP call had returned (#1424).
+   * So does the TTL deadline: the record it guards is judged by other pods'
+   * clocks, which no scheduler here can advance (#937).
    */
   private readonly scheduler: Scheduler | null;
   /**
@@ -172,6 +199,17 @@ export class KubernetesLease implements Lease {
    */
   private renewalInFlight: Promise<void> | null = null;
   private held = false;
+  /**
+   * When the last write the API server accepted from this holder was *sent* —
+   * the instant its `renewTime` was stamped, before the request went out.
+   *
+   * The TTL is measured from here, not from the response: other pods count the
+   * record's lifetime from that `renewTime`, so counting from the answer would
+   * trust the lease for one round trip longer than they do.  Only a write this
+   * process saw accepted moves it; a 409 re-read that finds this owner still on
+   * the record does not.
+   */
+  private acceptedWriteSentAt: Instant | null = null;
   private currentLease: K8sLeaseObject | null = null;
   private readonly onLostHandlers = new Set<(reason: string) => void>();
   private cachedCredentials: ResolvedCredentials | null = null;
@@ -203,8 +241,14 @@ export class KubernetesLease implements Lease {
     const validator = new KubernetesLeaseOptionsValidator();
     validator.validateRequired(this.options);
     validator.validate(this.options);
-    this.renewalIntervalMs = this.options.renewalIntervalMs
-      ?? Math.max(500, Math.floor(this.options.ttlMs / 3));
+    // A third of the TTL with a 500 ms floor, and never more than half of it: a
+    // renewal that only comes round after the deadline gives the lease up
+    // (#937), so the floor alone would lose any TTL of 500 ms or less on its
+    // first tick.  An interval set explicitly is taken as given.
+    this.renewalIntervalMs = this.options.renewalIntervalMs ?? Math.max(
+      1,
+      Math.min(Math.max(500, Math.floor(this.options.ttlMs / 3)), Math.floor(this.options.ttlMs / 2)),
+    );
     this.scheduler = this.options.scheduler ?? null;
     this.tokenReloadIntervalMs = this.options.tokenReloadIntervalMs
       ?? DEFAULT_TOKEN_RELOAD_INTERVAL_MS;
@@ -428,7 +472,8 @@ export class KubernetesLease implements Lease {
     const namespace = this.namespaceOf(credentials);
     const name = this.leaseName;
     const ttlSeconds = Math.max(1, Math.ceil(this.options.ttlMs / 1000));
-    const now = new Date().toISOString();
+    const sentAt = instantNow();
+    const now = new Date(sentAt.wall).toISOString();
 
     const existing = await getLease(credentials, namespace, name, this.callOptions);
 
@@ -443,6 +488,7 @@ export class KubernetesLease implements Lease {
       if (!created) return 'race';
       this.held = true;
       this.currentLease = created;
+      this.acceptedWriteSentAt = sentAt;
       this.startRenewalLoop();
       return 'success';
     }
@@ -469,6 +515,7 @@ export class KubernetesLease implements Lease {
     if (!result) return 'race';
     this.held = true;
     this.currentLease = result;
+    this.acceptedWriteSentAt = sentAt;
     this.startRenewalLoop();
     return 'success';
   }
@@ -550,7 +597,21 @@ export class KubernetesLease implements Lease {
       deleteLease(credentials, this.namespaceOf(credentials), this.leaseName, this.callOptions));
   }
 
-  checkAlive(): boolean { return this.held; }
+  /**
+   * Held, and the TTL has not run out since the last write the API server
+   * accepted was sent — on **either** clock (#937).
+   *
+   * `held` alone is only cleared by a renewal that notices the loss, and a
+   * stalled event loop is what keeps that renewal from running; meanwhile
+   * another pod may legitimately have taken the lease.  So the answer turns
+   * false at the deadline, before `onLost` has had a chance to fire.
+   *
+   * Two clocks, and either one running out is enough: the monotonic clock
+   * cannot be stepped back by NTP, which would otherwise stretch the TTL, and
+   * the wall clock still counts the time a suspended host lost, which the
+   * monotonic clock does not.
+   */
+  checkAlive(): boolean { return this.held && !this.hasExpired(instantNow()); }
 
   onLost(handler: (reason: string) => void): () => void {
     this.onLostHandlers.add(handler);
@@ -559,6 +620,23 @@ export class KubernetesLease implements Lease {
 
   /* ---------------------------- internals --------------------------- */
 
+  /** True once the TTL has passed on either clock since the last accepted write was sent. */
+  private hasExpired(now: Instant): boolean {
+    return this.millisecondsPastDeadline(now) >= 0;
+  }
+
+  /**
+   * How far `now` is past the deadline, on whichever clock is further along —
+   * negative while the lease is still good, and `Infinity` before any write was
+   * accepted at all.
+   */
+  private millisecondsPastDeadline(now: Instant): number {
+    const sent = this.acceptedWriteSentAt;
+    if (sent === null) return Number.POSITIVE_INFINITY;
+    const elapsedMs = Math.max(now.monotonic - sent.monotonic, now.wall - sent.wall);
+    return elapsedMs - this.options.ttlMs;
+  }
+
   private startRenewalLoop(): void {
     if (this.renewalTimer) return;
     const tick = (): void => { void this.renewOnce(); };
@@ -584,12 +662,27 @@ export class KubernetesLease implements Lease {
    * One renewal tick — or nothing at all, when the previous tick's PUT has
    * not come back yet.  See {@link renewalInFlight} for why a tick that
    * finds one outstanding is dropped rather than queued (#761).
+   *
+   * The deadline is checked first, ahead of that guard.  A tick that comes
+   * round after the TTL ran out has nothing left to renew — the record lapsed
+   * while this holder was not looking, and another pod may hold it by now — so
+   * it gives the lease up instead of extending it (#937).  Behind the guard,
+   * a renewal PUT hanging on the wire for up to `operationTimeoutMs` would hold
+   * that report back for as long.
    */
   private async renewOnce(): Promise<void> {
-    if (this.renewalInFlight !== null) return;
     const lease = this.currentLease;
     if (!this.held || lease === null) return;
-    const attempt = this.renewalPass(lease);
+    const sentAt = instantNow();
+    const pastDeadlineMs = this.millisecondsPastDeadline(sentAt);
+    if (pastDeadlineMs >= 0) {
+      this.fireLost(
+        `lease expired before it could be renewed (${Math.round(pastDeadlineMs)} ms past its deadline)`,
+      );
+      return;
+    }
+    if (this.renewalInFlight !== null) return;
+    const attempt = this.renewalPass(lease, sentAt);
     this.renewalInFlight = attempt;
     try {
       await attempt;
@@ -612,10 +705,10 @@ export class KubernetesLease implements Lease {
    * The snapshot is a parameter rather than a re-read of `currentLease`
    * because the field may be nulled by `release()` or `fireLost()` while
    * this is running; the write has to be built from the state the tick
-   * decided to renew.
+   * decided to renew.  `sentAt` is the instant the tick stamped it with.
    */
-  private async renewalPass(lease: K8sLeaseObject): Promise<void> {
-    const now = new Date().toISOString();
+  private async renewalPass(lease: K8sLeaseObject, sentAt: Instant): Promise<void> {
+    const now = new Date(sentAt.wall).toISOString();
     const ttlSeconds = Math.max(1, Math.ceil(this.options.ttlMs / 1000));
     const updated: K8sLeaseObject = {
       ...lease,
@@ -629,15 +722,22 @@ export class KubernetesLease implements Lease {
     try {
       const result = await this.withFreshCredentials((credentials) =>
         updateLease(credentials, updated, this.callOptions));
+      // Everything below acts on the lease this tick renewed, and only while it
+      // is still the current one.  `release()` or `fireLost()` may have dropped
+      // it while the PUT was on the wire — the deadline check in `renewOnce`
+      // does exactly that on purpose — and a re-`acquire()` after it installs
+      // a newer record.  An answer arriving late belongs to a lease that no
+      // longer exists: adopting it would put back a stale resourceVersion and
+      // an earlier deadline, and reporting it would call the newer lease lost.
+      if (this.currentLease !== lease) return;
       if (result === null) {
-        await this.reconcileRejectedRenewal();
+        await this.reconcileRejectedRenewal(lease);
         return;
       }
-      // Guarded because `release()` may have run while the PUT was on the
-      // wire: adopting a resourceVersion into a lease this process has
-      // already dropped would resurrect state nothing reads back.
-      if (this.held) this.currentLease = result;
+      this.currentLease = result;
+      this.acceptedWriteSentAt = sentAt;
     } catch (e) {
+      if (this.currentLease !== lease) return;
       const message = e instanceof K8sLeaseError
         ? `renewal http error: ${e.message}`
         : `renewal error: ${(e as Error).message}`;
@@ -672,10 +772,16 @@ export class KubernetesLease implements Lease {
    *
    * A re-read that fails outright falls through to the caller's catch and
    * fires `onLost`: ownership that cannot be confirmed may not be assumed.
+   *
+   * The re-read is a round trip of its own, so it is held to the same rule
+   * as the PUT before it: it speaks only for the `lease` the tick renewed.
+   * Neither outcome moves the deadline — the record was re-read, not
+   * re-written, and only a write this holder saw accepted does that.
    */
-  private async reconcileRejectedRenewal(): Promise<void> {
+  private async reconcileRejectedRenewal(lease: K8sLeaseObject): Promise<void> {
     const current = await this.withFreshCredentials((credentials) =>
       getLease(credentials, this.namespaceOf(credentials), this.leaseName, this.callOptions));
+    if (this.currentLease !== lease) return;
     if (current === null) {
       this.fireLost('lease lost during renewal (the lease object was deleted)');
       return;
@@ -688,7 +794,7 @@ export class KubernetesLease implements Lease {
       this.fireLost(`lease lost during renewal (now held by ${holder ? holder : 'nobody'})`);
       return;
     }
-    if (this.held) this.currentLease = current;
+    this.currentLease = current;
   }
 
   private fireLost(reason: string): void {
diff --git a/tests/integration/in-process/cluster/downing/DowningStrategies.test.ts b/tests/integration/in-process/cluster/downing/DowningStrategies.test.ts
index 7b5d087ba..aab5a17e0 100644
--- a/tests/integration/in-process/cluster/downing/DowningStrategies.test.ts
+++ b/tests/integration/in-process/cluster/downing/DowningStrategies.test.ts
@@ -13,8 +13,11 @@ import {
 } from '../../../../../src/cluster/downing/index.js';
 import { OptionsError } from '../../../../../src/util/OptionsValidator.js';
 import type { Lease } from '../../../../../src/coordination/Lease.js';
+import { InMemoryLease, inMemoryLeaseStore } from '../../../../../src/coordination/leases/InMemoryLease.js';
+import { LeaseOptions } from '../../../../../src/coordination/LeaseOptions.js';
 import { Member } from '../../../../../src/cluster/Member.js';
 import { NodeAddress } from '../../../../../src/cluster/NodeAddress.js';
+import { ManualScheduler } from '../../../../../src/testkit/ManualScheduler.js';
 import { sleep } from '../../../../util/AwaitCondition.js';
 
 const addr = (port: number, host = 'h'): NodeAddress => new NodeAddress('sys', host, port);
@@ -184,6 +187,12 @@ class FakeLease implements Lease {
   private nextAcquire: { resolve: (b: boolean) => void; reject: (e: Error) => void } | null = null;
   acquireCalls = 0;
   released = false;
+  /**
+   * Held from a won acquire until a release or {@link expire} — what the
+   * backends' `checkAlive()` reports.  A constant `false` was harmless while
+   * nothing read it; `LeaseMajority` now re-validates a win against it (#937).
+   */
+  private held = false;
 
   acquire(): Promise<boolean> {
     this.acquireCalls++;
@@ -195,6 +204,7 @@ class FakeLease implements Lease {
     const pending = this.nextAcquire;
     if (!pending) throw new Error('FakeLease.resolveAcquire: no acquire in flight');
     this.nextAcquire = null;
+    if (got) this.held = true;
     pending.resolve(got);
   }
   rejectAcquire(reason: string): void {
@@ -203,8 +213,13 @@ class FakeLease implements Lease {
     this.nextAcquire = null;
     pending.reject(new Error(reason));
   }
-  async release(): Promise<void> { this.released = true; }
-  checkAlive(): boolean { return false; }
+  /** What a stall past the TTL does to a backend's answer: the lease ran out. */
+  expire(): void { this.held = false; }
+  async release(): Promise<void> {
+    this.released = true;
+    this.held = false;
+  }
+  checkAlive(): boolean { return this.held; }
   onLost(): () => void { return () => {}; }
 }
 
@@ -281,6 +296,106 @@ describe('LeaseMajority', () => {
     // We are 1; reachable side is 1+2 — both should be downed.
     expect(after.has(addr(1).toString())).toBe(true);
     expect(after.has(addr(2).toString())).toBe(true);
+
+    // A lost arbitration does not rest on the lease, so it is not re-asked: this
+    // side does not hold the lease, and that is exactly why it goes (#937).
+    expect(strat.decide(clusterView)).toEqual(after);
+    expect(lease.acquireCalls).toBe(1);
+  });
+
+  test('a won arbitration is re-validated against the lease before it is returned again (#937)', async () => {
+    const lease = new FakeLease();
+    const leaseOptions = LeaseMajorityOptions.create().withLease(lease);
+    const strategy = new LeaseMajority(leaseOptions);
+    const clusterView = view([{ port: 1 }, { port: 2 }, { port: 3 }, { port: 4 }], [3, 4]);
+    expect(strategy.decide(clusterView).size).toBe(0);
+    lease.resolveAcquire(true);
+    await flushMicrotasks();
+    expect(strategy.decide(clusterView)).toEqual(new Set([addr(3).toString(), addr(4).toString()]));
+
+    // This node stalls past the TTL and the other side takes the lease.  The
+    // cached "down them" is no longer this side's to give: replaying it is how
+    // both halves came to act as the survivor.
+    lease.expire();
+    expect(strategy.decide(clusterView).size).toBe(0);
+    expect(lease.acquireCalls).toBe(2);
+    // And on every tick while that acquire is on the wire.  The cluster asks
+    // each failure-detector tick and applies whatever comes back, so a dropped
+    // win that resurfaced here would be acted on before the lease answered.
+    expect(strategy.decide(clusterView).size).toBe(0);
+    expect(lease.acquireCalls).toBe(2);
+
+    // The other side holds the lease now, so the fresh attempt loses — and this
+    // side downs itself.
+    lease.resolveAcquire(false);
+    await flushMicrotasks();
+    expect(strategy.decide(clusterView)).toEqual(new Set([addr(1).toString(), addr(2).toString()]));
+  });
+
+  test('a lapsed win that nobody took is won back, not given up (#937)', async () => {
+    const lease = new FakeLease();
+    const leaseOptions = LeaseMajorityOptions.create().withLease(lease);
+    const strategy = new LeaseMajority(leaseOptions);
+    const clusterView = view([{ port: 1 }, { port: 2 }, { port: 3 }, { port: 4 }], [3, 4]);
+    expect(strategy.decide(clusterView).size).toBe(0);
+    lease.resolveAcquire(true);
+    await flushMicrotasks();
+    expect(strategy.decide(clusterView).size).toBe(2);
+
+    // Re-validation re-arbitrates rather than conceding: a lease that ran out
+    // while nobody else wanted it is still this side's to take.  Until it is
+    // taken again, the old win stays dropped.
+    lease.expire();
+    expect(strategy.decide(clusterView).size).toBe(0);
+    expect(strategy.decide(clusterView).size).toBe(0);
+    lease.resolveAcquire(true);
+    await flushMicrotasks();
+    expect(strategy.decide(clusterView)).toEqual(new Set([addr(3).toString(), addr(4).toString()]));
+  });
+
+  test('two halves of a split cannot both keep a win when the winner stalls (#937)', async () => {
+    // Two real leases on one store and on virtual time: no timing in the test.
+    // A renewal cadence past the TTL is how the stall looks from the record's
+    // side — the winner's loop is armed and does not come round.
+    inMemoryLeaseStore._clear();
+    try {
+      const scheduler = new ManualScheduler();
+      const strategyFor = (owner: string): LeaseMajority => {
+        const leaseOptions = LeaseOptions.create()
+          .withName('split-937')
+          .withOwner(owner)
+          .withTtlMs(30_000)
+          .withRenewalIntervalMs(3_600_000)
+          .withScheduler(scheduler);
+        const leaseMajorityOptions = LeaseMajorityOptions.create().withLease(new InMemoryLease(leaseOptions));
+        return new LeaseMajority(leaseMajorityOptions);
+      };
+      const members = [{ port: 1 }, { port: 2 }, { port: 3 }, { port: 4 }];
+      const leftView = view(members, [3, 4], 1);
+      const rightView = view(members, [1, 2], 3);
+      const left = strategyFor('left');
+      const right = strategyFor('right');
+
+      // The left side arbitrates first and wins.
+      expect(left.decide(leftView).size).toBe(0);
+      await flushMicrotasks();
+      expect(left.decide(leftView)).toEqual(new Set([addr(3).toString(), addr(4).toString()]));
+
+      // Its holder stalls past the TTL, and the right side takes the lapsed lease
+      // legitimately.
+      scheduler.advance(30_000);
+      expect(right.decide(rightView).size).toBe(0);
+      await flushMicrotasks();
+      expect(right.decide(rightView)).toEqual(new Set([addr(1).toString(), addr(2).toString()]));
+
+      // Before #937 the left side replayed its cached win here, and each half
+      // downed the other.  It asks the lease again instead, loses, and goes.
+      expect(left.decide(leftView).size).toBe(0);
+      await flushMicrotasks();
+      expect(left.decide(leftView)).toEqual(new Set([addr(1).toString(), addr(2).toString()]));
+    } finally {
+      inMemoryLeaseStore._clear();
+    }
   });
 
   test('lease unreachable (acquire rejects): pending stays pending; next tick retries', async () => {
diff --git a/tests/integration/in-process/persistence/replicated/Lease.test.ts b/tests/integration/in-process/persistence/replicated/Lease.test.ts
index d9449ce44..50262d843 100644
--- a/tests/integration/in-process/persistence/replicated/Lease.test.ts
+++ b/tests/integration/in-process/persistence/replicated/Lease.test.ts
@@ -219,12 +219,15 @@ describe('ReplicatedEventSourcedActor — optional Lease (#89)', () => {
     const { sys, cluster } = await bootCluster('lease-loss', 70_003);
     let a: LeasedCounter | null = null;
     try {
-      // Short TTL so the renewal loop runs every ~70 ms — quick
-      // enough for the test to observe loss without a long sleep.
+      // A renewal every 50 ms, so the wipe below is found within a tick, and
+      // a TTL no stall on a loaded runner can cross: a renewal that comes round
+      // after the deadline gives the lease up (#937), and the only loss this
+      // case is about is the wipe.
       const leaseOptions = LeaseOptions.create()
         .withName('losable')
         .withOwner('a')
-        .withTtlMs(200);
+        .withTtlMs(2_000)
+        .withRenewalIntervalMs(50);
       const lease = new InMemoryLease(leaseOptions);
       sys.spawn(
         () => {
@@ -243,9 +246,9 @@ describe('ReplicatedEventSourcedActor — optional Lease (#89)', () => {
       // `onLost` exactly like a real backend would on a fence/TTL
       // expiry.
       inMemoryLeaseStore._clear();
-      // The renewal tick is ~70 ms on an idle machine; the old 200 ms budget
-      // was under three of them.  What the test is about is the *reaction* to
-      // loss, not the cadence, so wait for the callback.
+      // The renewal tick is 50 ms on an idle machine and longer on a loaded
+      // one.  What the test is about is the *reaction* to loss, not the
+      // cadence, so wait for the callback.
       await awaitCondition(() => a!.leaseLossEvents.length > 0, {
         ...WAIT, intervalMs: 20, label: 'the renewal loop reported the lost lease',
       });
diff --git a/tests/unit/ci/WallClockRatchet.test.ts b/tests/unit/ci/WallClockRatchet.test.ts
index 929347d55..18fb18fdc 100644
--- a/tests/unit/ci/WallClockRatchet.test.ts
+++ b/tests/unit/ci/WallClockRatchet.test.ts
@@ -91,8 +91,8 @@ const LEGACY_WALL_CLOCK_READS: Readonly<Record<string, number>> = {
   'src/cluster/sharding/ClusterSharding.ts': 1,
   'src/cluster/sharding/ShardCoordinator.ts': 6,
   'src/cluster/sharding/ShardRegion.ts': 9,
-  'src/coordination/leases/InMemoryLease.ts': 4,
-  'src/coordination/leases/KubernetesLease.ts': 6,
+  'src/coordination/leases/InMemoryLease.ts': 1,
+  'src/coordination/leases/KubernetesLease.ts': 4,
   'src/crdt/CrdtWireValidation.ts': 1,
   'src/crdt/DistributedData.ts': 2,
   'src/crdt/LWWMap.ts': 2,
diff --git a/tests/unit/coordination/InMemoryLease.test.ts b/tests/unit/coordination/InMemoryLease.test.ts
index e26e1d7d7..a63246e3a 100644
--- a/tests/unit/coordination/InMemoryLease.test.ts
+++ b/tests/unit/coordination/InMemoryLease.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, test, beforeEach } from 'bun:test';
 import { InMemoryLease, LeaseOptions, inMemoryLeaseStore } from '../../../src/coordination/index.js';
 import { OptionsError } from '../../../src/util/OptionsValidator.js';
+import { ManualScheduler } from '../../../src/testkit/ManualScheduler.js';
 import { sleep } from '../../util/AwaitCondition.js';
 
 beforeEach(() => {
@@ -91,17 +92,22 @@ describe('InMemoryLease', () => {
   });
 
   test('renewal keeps the lease alive past the initial TTL', async () => {
+    // On virtual time (#1424).  On the wall clock a loaded runner can hold the
+    // 40 ms renewal back past the 120 ms TTL, and since #937 a renewal that comes
+    // round after the deadline gives the lease up — correctly, and not what
+    // this case is about.
+    const scheduler = new ManualScheduler();
     const leaseOptions = LeaseOptions.create()
       .withName('d')
       .withOwner('A')
       .withTtlMs(120)
-      .withRenewalIntervalMs(40);
-    const lease = new InMemoryLease(
-      leaseOptions,
-    );
+      .withRenewalIntervalMs(40)
+      .withScheduler(scheduler);
+    const lease = new InMemoryLease(leaseOptions);
     await lease.acquire();
-    await sleep(300); // several TTL spans — renewal must kick in
+    scheduler.advance(360); // three TTL spans — renewal must kick in
     expect(lease.checkAlive()).toBe(true);
+    expect(inMemoryLeaseStore.peek('d', scheduler.now())?.owner).toBe('A');
     await lease.release();
   });
 
@@ -156,6 +162,13 @@ describe('InMemoryLease', () => {
 
     const leaseB = new InMemoryLease(leaseOptions2);
     expect(await leaseB.acquire()).toBe(true);
+    // The holder whose renewal never ran does not go on believing it holds the
+    // lease B now has (#937).
+    expect(leaseA.checkAlive()).toBe(false);
+    // Disarms A's 100-second renewal timer; the record is B's, so the store is
+    // left alone.
+    await leaseA.release();
+    expect(leaseB.checkAlive()).toBe(true);
     await leaseB.release();
   });
 });
diff --git a/tests/unit/coordination/KubernetesLease.test.ts b/tests/unit/coordination/KubernetesLease.test.ts
index 20987f7f2..fec8f732a 100644
--- a/tests/unit/coordination/KubernetesLease.test.ts
+++ b/tests/unit/coordination/KubernetesLease.test.ts
@@ -1,5 +1,6 @@
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { afterEach, beforeEach, describe, expect, mock, spyOn, test } from 'bun:test';
 import { OptionsError } from '../../../src/util/OptionsValidator.js';
+import { ManualScheduler } from '../../../src/testkit/ManualScheduler.js';
 import { KubernetesLease } from '../../../src/coordination/leases/KubernetesLease.js';
 import { KubernetesLeaseOptions, type KubernetesLeaseOptionsType } from '../../../src/coordination/leases/KubernetesLeaseOptions.js';
 import type {
@@ -305,6 +306,7 @@ const baseOptions = (overrides: Partial<KubernetesLeaseOptionsType> = {}): Kuber
   if (s.authToken !== undefined) options.withAuthToken(s.authToken);
   if (s.caCert !== undefined) options.withCaCert(s.caCert);
   if (s.client !== undefined) options.withClient(s.client);
+  if (s.scheduler !== undefined) options.withScheduler(s.scheduler);
   return options;
 };
 
@@ -756,6 +758,522 @@ describe('KubernetesLease — renewal loop', () => {
   });
 });
 
+/**
+ * #937 — a holder whose renewal did not come round in time must stop believing
+ * it holds the lease.
+ *
+ * The renewal cadence goes on a `ManualScheduler` that only the test advances,
+ * which is how a blocked event loop looks from the lease's side: the loop is
+ * armed and does not come round.  The TTL stays on real time, as in production
+ * — it is measured from when this holder's own writes were sent, and that is
+ * not something a scheduler paces.
+ */
+describe('KubernetesLease — a holder whose renewal did not come round in time (#937)', () => {
+  const stalledOptions = (
+    overrides: Partial<KubernetesLeaseOptionsType> = {},
+  ): { scheduler: ManualScheduler; leaseOptions: KubernetesLeaseOptions } => {
+    const scheduler = new ManualScheduler();
+    const leaseOptions = baseOptions({ ttlMs: 100, renewalIntervalMs: 20, scheduler, ...overrides });
+    return { scheduler, leaseOptions };
+  };
+
+  test('checkAlive turns false at the deadline while the record still names this holder', async () => {
+    const { leaseOptions } = stalledOptions();
+    const lease = new KubernetesLease(leaseOptions);
+    expect(await lease.acquire()).toBe(true);
+
+    await awaitCondition(() => !lease.checkAlive(), { label: 'the 100 ms TTL ran out' });
+
+    // Nothing was taken from it: the record still names this pod.  What ran out
+    // is the guarantee — past this point another pod may take the lease.
+    expect(server.peek('default', 'test-lease')!.spec.holderIdentity).toBe('test-pod');
+    await lease.release();
+  });
+
+  test('a renewal that comes round after the deadline gives the lease up and sends nothing', async () => {
+    const { scheduler, leaseOptions } = stalledOptions();
+    const lease = new KubernetesLease(leaseOptions);
+    const reasons: string[] = [];
+    lease.onLost((reason) => { reasons.push(reason); });
+    expect(await lease.acquire()).toBe(true);
+    await awaitCondition(() => !lease.checkAlive(), { label: 'the 100 ms TTL ran out' });
+    const requestsBefore = server.log.length;
+
+    // The tick a stalled event loop finally gets round to.
+    scheduler.advance(20);
+    await awaitCondition(() => reasons.length > 0, { label: 'the late renewal reported the expiry' });
+
+    expect(reasons).toHaveLength(1);
+    expect(reasons[0]).toMatch(/^lease expired before it could be renewed \(\d+ ms past its deadline\)$/);
+    // No PUT extending a record this pod can no longer vouch for.
+    expect(server.log.slice(requestsBefore)).toEqual([]);
+  });
+
+  test('a renewal PUT parked past the deadline does not hold the report back', async () => {
+    // 500 ms rather than 100: the first renewal has to be sent while the lease
+    // is still good, and that should not hinge on a loaded runner's next 100 ms.
+    const { scheduler, leaseOptions } = stalledOptions({ ttlMs: 500 });
+    const lease = new KubernetesLease(leaseOptions);
+    const reasons: string[] = [];
+    lease.onLost((reason) => { reasons.push(reason); });
+    expect(await lease.acquire()).toBe(true);
+
+    // The first renewal reaches the API server and hangs there for longer than
+    // the TTL — the latency spike #761 is about, held open past the deadline.
+    server.blockPuts();
+    scheduler.advance(20);
+    await awaitCondition(() => server.parkedPuts() === 1, { label: 'the renewal PUT reached the API server' });
+    await awaitCondition(() => !lease.checkAlive(), { label: 'the 500 ms TTL ran out under the parked PUT' });
+
+    // The next tick finds that PUT still on the wire.  Skipping it there would
+    // leave the report to whenever the request gives up — up to
+    // `operationTimeoutMs`, ten seconds by default.
+    scheduler.advance(20);
+    await awaitCondition(() => reasons.length > 0, { label: 'the expiry was reported with the PUT still parked' });
+    expect(reasons[0]).toMatch(/^lease expired before it could be renewed/);
+    expect(server.parkedPuts()).toBe(1);
+
+    // The parked PUT lands after all, against a lease this holder has given up.
+    server.unblockPuts();
+    await awaitCondition(() => server.parkedPuts() === 0, { label: 'the parked PUT was answered' });
+    expect(lease.checkAlive()).toBe(false);
+    expect(reasons).toHaveLength(1);
+  });
+
+  test('two holders never both report alive for the same lease', async () => {
+    const { leaseOptions: stalledHolderOptions } = stalledOptions({ owner: 'pod-a' });
+    const stalled = new KubernetesLease(stalledHolderOptions);
+    expect(await stalled.acquire()).toBe(true);
+    await awaitCondition(() => !stalled.checkAlive(), { label: "pod-a's 100 ms TTL ran out" });
+
+    // What a long pause on pod-a leaves behind, from pod-b's side: a record whose
+    // renewTime lapsed a minute ago.  It cannot lapse any sooner than pod-a's own
+    // deadline, which is why the wait above comes first.
+    const record = server.peek('default', 'test-lease')!;
+    server.seedLease('default', {
+      ...record,
+      spec: { ...record.spec, renewTime: new Date(Date.now() - 60_000).toISOString() },
+    });
+    const successorOptions = baseOptions({ owner: 'pod-b' });
+    const successor = new KubernetesLease(successorOptions);
+    expect(await successor.acquire()).toBe(true);
+
+    expect(stalled.checkAlive()).toBe(false);
+    expect(successor.checkAlive()).toBe(true);
+    // Nor does asking again bring the stalled holder back: it loses the
+    // re-acquire, and a lost acquire leaves its deadline where it was.
+    expect(await stalled.acquire()).toBe(false);
+    expect(stalled.checkAlive()).toBe(false);
+    await successor.release();
+  });
+
+  test('a wall clock that jumped past the deadline — a host that was suspended — reads as expired', async () => {
+    const { leaseOptions } = stalledOptions({ ttlMs: 5_000 });
+    const lease = new KubernetesLease(leaseOptions);
+    expect(await lease.acquire()).toBe(true);
+    expect(lease.checkAlive()).toBe(true);
+
+    // A suspended host stops the monotonic clock along with everything else, so
+    // `performance.now()` alone would see no time pass.  The wall clock catches
+    // up on resume, and either clock running out is enough.
+    const resumedAt = Date.now() + 60_000;
+    const wallClock = spyOn(Date, 'now').mockReturnValue(resumedAt);
+    try {
+      expect(lease.checkAlive()).toBe(false);
+    } finally {
+      wallClock.mockRestore();
+    }
+    await lease.release();
+  });
+
+  test('a wall clock stepped backwards does not stretch the TTL', async () => {
+    const { leaseOptions } = stalledOptions();
+    const lease = new KubernetesLease(leaseOptions);
+    expect(await lease.acquire()).toBe(true);
+
+    // NTP steps the clock back an hour right after the write.  Judged on the
+    // wall clock alone, the lease would look good for another hour; the
+    // monotonic clock still sees the 100 ms go by.
+    const realNow = Date.now;
+    const wallClock = spyOn(Date, 'now').mockImplementation(() => realNow() - 3_600_000);
+    try {
+      await awaitCondition(() => !lease.checkAlive(), { label: 'the 100 ms TTL ran out on the monotonic clock' });
+    } finally {
+      wallClock.mockRestore();
+    }
+    await lease.release();
+  });
+});
+
+/**
+ * #937, the healthy half: what moves the deadline, and what does not.
+ *
+ * The cases above only ever let it run out.  These pin the rules that keep a
+ * lease which *is* being renewed alive — and they need both of the deadline's
+ * clocks under the test's control, next to the cadence that is already on a
+ * `ManualScheduler`, so that "three TTLs of healthy renewals" takes no real
+ * time and no loaded runner decides whether a renewal landed in time.
+ */
+describe('KubernetesLease — what moves the deadline (#937)', () => {
+  // Every case restores its clocks in a `finally`; this is the net under that.
+  // With `performance.now()` frozen, an `awaitCondition` in here would never
+  // reach its timeout, and leaked spies would freeze every later file too.
+  afterEach(() => { mock.restore(); });
+
+  /** `performance.now()` and `Date.now()`, frozen and moved together by hand. */
+  const handDrivenClocks = (): { advance: (ms: number) => void; restore: () => void } => {
+    const monotonicStart = performance.now();
+    const wallStart = Date.now();
+    let elapsedMs = 0;
+    const monotonic = spyOn(performance, 'now').mockImplementation(() => monotonicStart + elapsedMs);
+    const wall = spyOn(Date, 'now').mockImplementation(() => wallStart + elapsedMs);
+    return {
+      advance: (ms) => { elapsedMs += ms; },
+      restore: () => {
+        monotonic.mockRestore();
+        wall.mockRestore();
+      },
+    };
+  };
+
+  /**
+   * One macrotask turn.  The fake API server answers in microtasks, so this is
+   * enough for a renewal the scheduler just fired to make its whole round trip.
+   * It waits on no time at all — the clocks are hand-driven here.
+   */
+  const nextTurn = (): Promise<void> => new Promise<void>((resolve) => { setImmediate(resolve); });
+
+  /**
+   * The fake API server, with one answer held back until the test lets it go.
+   *
+   * `hold(method)` arms it for the next request with that method.  `landed`
+   * lets the request reach the server at once — so its answer describes the
+   * record as it was then — and delays only the answer; `failed` never sends
+   * it and fails it on release.  `FakeK8sServer.blockPuts()` parks a PUT
+   * before the store sees it; this is the other half, an answer still on its
+   * way back.
+   */
+  const withHeldBackAnswer = (): {
+    client: K8sFetchClient;
+    hold: (method: string, outcome?: 'landed' | 'failed') => void;
+    letGo: () => void;
+  } => {
+    const armed: { method?: string; outcome?: 'landed' | 'failed' } = {};
+    const held: { letGo?: () => void } = {};
+    const client: K8sFetchClient = {
+      request: async (credentials, options) => {
+        if (armed.method !== options.method) return await server.request(credentials, options);
+        const outcome = armed.outcome;
+        delete armed.method;
+        const response = outcome === 'landed' ? await server.request(credentials, options) : null;
+        await new Promise<void>((resolve) => { held.letGo = resolve; });
+        if (response === null) throw new Error('socket hang up');
+        return response;
+      },
+    };
+    return {
+      client,
+      hold: (method, outcome = 'landed') => {
+        armed.method = method;
+        armed.outcome = outcome;
+      },
+      letGo: () => { held.letGo?.(); },
+    };
+  };
+
+  test('a holder that keeps renewing stays alive past its TTL, until it releases', async () => {
+    const scheduler = new ManualScheduler();
+    const leaseOptions = baseOptions({ ttlMs: 300, renewalIntervalMs: 20, scheduler });
+    const lease = new KubernetesLease(leaseOptions);
+    const reasons: string[] = [];
+    lease.onLost((reason) => { reasons.push(reason); });
+    const clocks = handDrivenClocks();
+    try {
+      expect(await lease.acquire()).toBe(true);
+
+      // Three TTLs, with every 20 ms renewal let through and answered.
+      for (let elapsedMs = 0; elapsedMs < 900; elapsedMs += 20) {
+        clocks.advance(20);
+        scheduler.advance(20);
+        await nextTurn();
+      }
+      expect(reasons).toEqual([]);
+      expect(lease.checkAlive()).toBe(true);
+
+      // A release ends it at once, with the deadline still ahead.
+      await lease.release();
+      expect(lease.checkAlive()).toBe(false);
+    } finally {
+      clocks.restore();
+    }
+  });
+
+  test('the deadline counts from when a renewal was sent, not from when it was answered', async () => {
+    const scheduler = new ManualScheduler();
+    const leaseOptions = baseOptions({ ttlMs: 300, renewalIntervalMs: 20, scheduler });
+    const lease = new KubernetesLease(leaseOptions);
+    const clocks = handDrivenClocks();
+    try {
+      expect(await lease.acquire()).toBe(true);
+
+      // The renewal is stamped and sent 100 ms in, and answered 150 ms later.
+      clocks.advance(100);
+      server.blockPuts();
+      scheduler.advance(20);
+      await nextTurn();
+      expect(server.parkedPuts()).toBe(1);
+      clocks.advance(150);
+      server.unblockPuts();
+      await nextTurn();
+
+      // The record carries that same instant.  Other pods judge the lease by
+      // its renewTime, so the deadline may count from nothing later — and the
+      // renewal must not write an earlier one either.
+      const renewTimeMs = Date.parse(server.peek('default', 'test-lease')!.spec.renewTime!);
+      expect(renewTimeMs + 300 - Date.now()).toBe(150);
+
+      // Good until the send time plus the TTL — 400 ms in — and not a moment
+      // later: other pods count from the stamp, never from the answer.
+      clocks.advance(149);
+      expect(lease.checkAlive()).toBe(true);
+      clocks.advance(1);
+      expect(lease.checkAlive()).toBe(false);
+    } finally {
+      clocks.restore();
+    }
+  });
+
+  test('a renewal that 409s against its own record does not move the deadline', async () => {
+    const scheduler = new ManualScheduler();
+    const leaseOptions = baseOptions({ ttlMs: 300, renewalIntervalMs: 20, scheduler });
+    const lease = new KubernetesLease(leaseOptions);
+    const reasons: string[] = [];
+    lease.onLost((reason) => { reasons.push(reason); });
+    const clocks = handDrivenClocks();
+    try {
+      expect(await lease.acquire()).toBe(true);
+
+      // Something else touches the object without taking it, so the renewal
+      // sent 200 ms in is rejected and the re-read finds this owner (#761).
+      clocks.advance(200);
+      server.bumpResourceVersion('default', 'test-lease');
+      scheduler.advance(20);
+      await nextTurn();
+      expect(reasons).toEqual([]);
+      expect(lease.checkAlive()).toBe(true);
+
+      // Re-read, not re-written: the deadline is still the acquire's.
+      clocks.advance(100);
+      expect(lease.checkAlive()).toBe(false);
+    } finally {
+      clocks.restore();
+    }
+  });
+
+  test('the derived renewal interval stays inside a TTL below the 500 ms floor', async () => {
+    // A third of 400 ms is under the 500 ms floor, and the floor alone would
+    // first renew after the deadline; capped at half the TTL it is 200 ms.
+    const scheduler = new ManualScheduler();
+    const leaseOptions = baseOptions({ ttlMs: 400, renewalIntervalMs: undefined, scheduler });
+    const lease = new KubernetesLease(leaseOptions);
+    const reasons: string[] = [];
+    lease.onLost((reason) => { reasons.push(reason); });
+    const clocks = handDrivenClocks();
+    try {
+      expect(await lease.acquire()).toBe(true);
+      const renewals = (): number => server.log.filter((entry) => entry.method === 'PUT').length;
+
+      // The first renewal goes out at 200 ms — half the TTL — and not before.
+      clocks.advance(199);
+      scheduler.advance(199);
+      await nextTurn();
+      expect(renewals()).toBe(0);
+      clocks.advance(1);
+      scheduler.advance(1);
+      await nextTurn();
+      expect(renewals()).toBe(1);
+
+      for (let elapsedMs = 200; elapsedMs < 1_200; elapsedMs += 100) {
+        clocks.advance(100);
+        scheduler.advance(100);
+        await nextTurn();
+      }
+      expect(reasons).toEqual([]);
+      expect(lease.checkAlive()).toBe(true);
+    } finally {
+      clocks.restore();
+    }
+    await lease.release();
+  });
+
+  /**
+   * An acquire's write, answered 200 ms after it was sent: the deadline is the
+   * send time plus the TTL, as for a renewal.  Counting from the answer would
+   * keep this holder alive for 200 ms past the moment another pod — reading
+   * the record's `renewTime`, which is the send time — may take the lease.
+   */
+  const acquireAnsweredLate = async (method: 'POST' | 'PUT'): Promise<void> => {
+    const scheduler = new ManualScheduler();
+    const answers = withHeldBackAnswer();
+    const leaseOptions = baseOptions({ ttlMs: 300, renewalIntervalMs: 20, scheduler, client: answers.client });
+    const lease = new KubernetesLease(leaseOptions);
+    const clocks = handDrivenClocks();
+    try {
+      answers.hold(method);
+      const acquiring = lease.acquire();
+      await nextTurn();
+      clocks.advance(200);
+      answers.letGo();
+      expect(await acquiring).toBe(true);
+
+      clocks.advance(99);
+      expect(lease.checkAlive()).toBe(true);
+      clocks.advance(1);
+      expect(lease.checkAlive()).toBe(false);
+    } finally {
+      clocks.restore();
+    }
+  };
+
+  test('an acquire that creates the record counts its deadline from when the CREATE was sent', async () => {
+    await acquireAnsweredLate('POST');
+  });
+
+  test('an acquire that takes over a lapsed record counts its deadline from when the PUT was sent', async () => {
+    server.seedLease('default', {
+      apiVersion: 'coordination.k8s.io/v1',
+      kind: 'Lease',
+      metadata: { name: 'test-lease', namespace: 'default' },
+      spec: {
+        holderIdentity: 'dead-pod',
+        leaseDurationSeconds: 1,
+        renewTime: new Date(Date.now() - 60_000).toISOString(),
+        leaseTransitions: 1,
+      },
+    });
+    await acquireAnsweredLate('PUT');
+  });
+
+  test("an acquire's deadline is the renewTime it wrote plus the TTL, however late the GET before it was answered", async () => {
+    // When the stamp is taken matters less than that the record and the local
+    // deadline share it: other pods judge the lease by the record's renewTime,
+    // so a deadline from any later reading would outlast theirs.
+    const scheduler = new ManualScheduler();
+    const answers = withHeldBackAnswer();
+    const leaseOptions = baseOptions({ ttlMs: 300, renewalIntervalMs: 20, scheduler, client: answers.client });
+    const lease = new KubernetesLease(leaseOptions);
+    const clocks = handDrivenClocks();
+    try {
+      answers.hold('GET');
+      const acquiring = lease.acquire();
+      await nextTurn();
+      clocks.advance(200);
+      answers.letGo();
+      expect(await acquiring).toBe(true);
+
+      const renewTimeMs = Date.parse(server.peek('default', 'test-lease')!.spec.renewTime!);
+      const untilRecordLapsesMs = renewTimeMs + 300 - Date.now();
+      clocks.advance(untilRecordLapsesMs - 1);
+      expect(lease.checkAlive()).toBe(true);
+      clocks.advance(1);
+      expect(lease.checkAlive()).toBe(false);
+    } finally {
+      clocks.restore();
+    }
+  });
+
+  for (const outcome of ['landed', 'failed'] as const) {
+    test(`a renewal answer that arrives after the lease was given up and re-acquired is ignored (${outcome})`, async () => {
+      const scheduler = new ManualScheduler();
+      const answers = withHeldBackAnswer();
+      const leaseOptions = baseOptions({ ttlMs: 300, renewalIntervalMs: 20, scheduler, client: answers.client });
+      const lease = new KubernetesLease(leaseOptions);
+      const reasons: string[] = [];
+      lease.onLost((reason) => { reasons.push(reason); });
+      const clocks = handDrivenClocks();
+      try {
+        expect(await lease.acquire()).toBe(true);
+
+        // The first renewal goes out and its answer does not come back before
+        // the deadline, so the next tick gives the lease up.  The acquire
+        // CREATEd, so the next PUT is that renewal.
+        answers.hold('PUT', outcome);
+        scheduler.advance(20);
+        await nextTurn();
+        clocks.advance(300);
+        scheduler.advance(20);
+        expect(reasons).toHaveLength(1);
+        expect(reasons[0]).toMatch(/^lease expired before it could be renewed/);
+
+        // The consumer re-acquires on the same instance, as the singleton
+        // manager does — and only then does the old answer arrive.
+        expect(await lease.acquire()).toBe(true);
+        answers.letGo();
+        await nextTurn();
+
+        // It belongs to the lease that was given up.  Adopting it would put
+        // the deadline back to the old send time; reporting it would call the
+        // new lease lost.
+        clocks.advance(299);
+        expect(reasons).toHaveLength(1);
+        expect(lease.checkAlive()).toBe(true);
+      } finally {
+        clocks.restore();
+      }
+      await lease.release();
+    });
+  }
+
+  test('a 409 re-read that arrives after the lease was given up and re-acquired is ignored', async () => {
+    const scheduler = new ManualScheduler();
+    const answers = withHeldBackAnswer();
+    const leaseOptions = baseOptions({ ttlMs: 300, renewalIntervalMs: 20, scheduler, client: answers.client });
+    const lease = new KubernetesLease(leaseOptions);
+    const reasons: string[] = [];
+    lease.onLost((reason) => { reasons.push(reason); });
+    const clocks = handDrivenClocks();
+    try {
+      expect(await lease.acquire()).toBe(true);
+
+      // A pod whose record has long lapsed writes over this one, so the next
+      // renewal is rejected; the re-read that follows sees that pod on the
+      // record, and its answer is held back.
+      server.seedLease('default', {
+        apiVersion: 'coordination.k8s.io/v1',
+        kind: 'Lease',
+        metadata: { name: 'test-lease', namespace: 'default' },
+        spec: {
+          holderIdentity: 'other-pod',
+          leaseDurationSeconds: 1,
+          renewTime: new Date(Date.now() - 60_000).toISOString(),
+          leaseTransitions: 2,
+        },
+      });
+      answers.hold('GET');
+      scheduler.advance(20);
+      await nextTurn();
+
+      // The deadline passes while it is on its way back, the lease is given up,
+      // and the consumer takes the lapsed record over on the same instance.
+      clocks.advance(300);
+      scheduler.advance(20);
+      expect(reasons).toHaveLength(1);
+      expect(await lease.acquire()).toBe(true);
+
+      // The re-read describes a record this holder has since replaced.  Acting
+      // on it would report the new lease lost to `other-pod`.
+      answers.letGo();
+      await nextTurn();
+      clocks.advance(299);
+      expect(reasons).toHaveLength(1);
+      expect(lease.checkAlive()).toBe(true);
+    } finally {
+      clocks.restore();
+    }
+    await lease.release();
+  });
+});
+
 describe('KubernetesLease — credential freshness (#760)', () => {
   /**
    * The credential used to be memoised for the process lifetime, both
diff --git a/tests/unit/coordination/LeaseClock.test.ts b/tests/unit/coordination/LeaseClock.test.ts
index 775a233ec..be5f3f283 100644
--- a/tests/unit/coordination/LeaseClock.test.ts
+++ b/tests/unit/coordination/LeaseClock.test.ts
@@ -152,3 +152,148 @@ describe('a lease measures its TTL on its scheduler', () => {
     }
   });
 });
+
+/**
+ * #937 — a holder whose renewal did not come round in time must stop believing
+ * it holds the lease.
+ *
+ * A renewal cadence past the TTL is how a stall looks from the lease's side: the
+ * loop is armed, and a blocked event loop — a GC pause, a starved container —
+ * keeps it from running until the record has lapsed.  `checkAlive()` used to
+ * answer from a flag that only a renewal could clear, and the renewal that
+ * finally ran extended the lapsed record instead of giving it up.
+ */
+describe('a holder whose renewal did not come round in time (#937)', () => {
+  const stalledLeaseFor = (
+    owner: string,
+    scheduler: ManualScheduler,
+    renewalIntervalMs = 3_600_000,
+  ): InMemoryLease => {
+    const leaseOptions = LeaseOptions.create()
+      .withName('virtual-lease')
+      .withOwner(owner)
+      .withTtlMs(30_000)
+      .withRenewalIntervalMs(renewalIntervalMs)
+      .withScheduler(scheduler);
+    return new InMemoryLease(leaseOptions);
+  };
+
+  test('checkAlive turns false at the deadline, with no renewal having run', async () => {
+    const scheduler = new ManualScheduler();
+    const holder = stalledLeaseFor('node-a', scheduler);
+    expect(await holder.acquire()).toBe(true);
+
+    scheduler.advance(29_999);
+    expect(holder.checkAlive()).toBe(true);
+
+    // The deadline itself is where the store lets another owner in, so it is
+    // where this holder has to let go.
+    scheduler.advance(1);
+    expect(holder.checkAlive()).toBe(false);
+  });
+
+  test('two holders never both report alive for the same lease', async () => {
+    const scheduler = new ManualScheduler();
+    const stalled = stalledLeaseFor('node-a', scheduler);
+    const successor = leaseFor('node-b', scheduler);
+    expect(await stalled.acquire()).toBe(true);
+
+    scheduler.advance(30_000);
+    expect(await successor.acquire()).toBe(true);
+
+    expect(stalled.checkAlive()).toBe(false);
+    expect(successor.checkAlive()).toBe(true);
+    // Nor does asking again bring the stalled holder back: it loses the
+    // re-acquire, and a lost acquire leaves its deadline where it was.
+    expect(await stalled.acquire()).toBe(false);
+    expect(stalled.checkAlive()).toBe(false);
+  });
+
+  test('a renewal that comes round after the deadline gives the lease up instead of extending it', async () => {
+    const scheduler = new ManualScheduler();
+    const before = scheduler.pendingCount;
+    // The first renewal is due ten seconds after the record lapsed.
+    const holder = stalledLeaseFor('node-a', scheduler, 40_000);
+    expect(await holder.acquire()).toBe(true);
+    const reasons: string[] = [];
+    holder.onLost((reason) => { reasons.push(reason); });
+
+    scheduler.advance(40_000);
+
+    expect(reasons).toEqual(['lease expired before it could be renewed (10000 ms past its deadline)']);
+    expect(holder.checkAlive()).toBe(false);
+    // Nothing was written back: the record stays lapsed, free for whoever asks
+    // next, rather than handed back to a holder that could not keep it.
+    expect(inMemoryLeaseStore.peek('virtual-lease', scheduler.now())).toBeUndefined();
+    // And the loop is disarmed.  `release()` returns early once the lease is
+    // lost, so it is not the one to stop an interval left running here.
+    expect(scheduler.pendingCount).toBe(before);
+  });
+
+  test('the store refuses to renew a record that has already lapsed', () => {
+    const acquiredAt = 1_000;
+    expect(inMemoryLeaseStore.tryAcquire('virtual-lease', 'node-a', acquiredAt + 30_000, acquiredAt))
+      .toBeGreaterThan(0);
+
+    // One millisecond before the deadline the record is still the holder's to extend…
+    const renewedAt = acquiredAt + 29_999;
+    expect(inMemoryLeaseStore.renew('virtual-lease', 'node-a', renewedAt + 30_000, renewedAt)).toBe(true);
+    // …and at the new deadline it no longer is.
+    const lateAt = renewedAt + 30_000;
+    expect(inMemoryLeaseStore.renew('virtual-lease', 'node-a', lateAt + 30_000, lateAt)).toBe(false);
+  });
+
+  test('release ends checkAlive at once, with the deadline still ahead', async () => {
+    const scheduler = new ManualScheduler();
+    const holder = leaseFor('node-a', scheduler);
+    expect(await holder.acquire()).toBe(true);
+
+    await holder.release();
+
+    // The record is gone and any other owner may take it now, so the expiry
+    // this holder wrote no longer speaks for it.
+    expect(holder.checkAlive()).toBe(false);
+  });
+
+  test('re-acquiring a lease it already holds arms no second renewal loop', async () => {
+    // `LeaseMajority` does exactly this: it never releases a lease it won, and
+    // the next equal split acquires on the same instance again.
+    const scheduler = new ManualScheduler();
+    const before = scheduler.pendingCount;
+    const holder = leaseFor('node-a', scheduler);
+
+    expect(await holder.acquire()).toBe(true);
+    const armed = scheduler.pendingCount;
+    expect(await holder.acquire()).toBe(true);
+    expect(scheduler.pendingCount).toBe(armed);
+
+    await holder.release();
+    expect(scheduler.pendingCount).toBe(before);
+  });
+
+  test('a TTL below the cadence floor is still renewed inside every TTL', async () => {
+    // The derived cadence is a third of the TTL with a 100 ms floor, so a 90 ms
+    // TTL used to be renewed every 100 ms — after the record had lapsed, which
+    // only worked while a late renewal extended a lapsed record.
+    const scheduler = new ManualScheduler();
+    const leaseOptions = LeaseOptions.create()
+      .withName('virtual-lease')
+      .withOwner('node-a')
+      .withTtlMs(90)
+      .withScheduler(scheduler);
+    const holder = new InMemoryLease(leaseOptions);
+    expect(await holder.acquire()).toBe(true);
+
+    // Capped at half the TTL, the first renewal lands at 45 ms and pushes the
+    // record from 90 to 135.
+    scheduler.advance(44);
+    expect(inMemoryLeaseStore.peek('virtual-lease', scheduler.now())?.expiresAt).toBe(90);
+    scheduler.advance(1);
+    expect(inMemoryLeaseStore.peek('virtual-lease', scheduler.now())?.expiresAt).toBe(135);
+
+    scheduler.advance(855);
+
+    expect(holder.checkAlive()).toBe(true);
+    expect(inMemoryLeaseStore.peek('virtual-lease', scheduler.now())?.owner).toBe('node-a');
+  });
+});