A replica that cannot list members keeps its shards after its leases expire

Behavior#

At each tick, the shard coordinator renews its member lease and lists the live members. If the list fails, the tick stops. The replica does not renew its shard leases, and keeps its current set of owned shards.

Effect#

When the list keeps failing, for example during a network partition, the shard leases expire. Another replica takes the shards, but the first replica still acts on them. Two replicas can then reconcile the same Releases.

Workaround#

None known.

Fix direction#

Drop the owned shards when a shard lease cannot be renewed before it expires.