The ID layout can't collide on paper. Production found two ways.

transcript

This ID layout can't produce a duplicate. On paper. In production, it can. Two ways. Neither one is in the bits.

Way one: two generators share a worker ID. Two copies of one deploy template, both saying 17. Or a paused VM wakes up, still using a number it lost. Way two: the clock goes backwards. NTP steps it back. Or the VM moves hosts. Or an operator fixes the time by hand. Now a used millisecond comes round again.

Fix one. Worker IDs come from etcd as leases. Say 30 seconds. The instance renews every 10 seconds. A renewal fails? Stop issuing IDs. That stops the zombie VM. Got it back? Wait longer than the max clock skew, then carry on.

Fix two. The clock steps back a few milliseconds? Wait until it passes the last one used. A big jump? Refuse to generate, and alert. Never issue duplicates silently. And prevent it. Run NTP in slewing mode. It adjusts the rate, never jumps.

And never put worker IDs in config files. That's how you get two 17s. The layout was never the risk. A clock you trust, a worker number nobody shares.

Full breakdown in the lecture.