While raising a 6-node ccm cluster to test 4.0-beta4, 2 nodes chosen the same tokens using the default allocate_tokens_for_local_rf. However they both succeeded bootstrap with colliding tokens.
However, since this is the default behavior, we should try to detect and prevent this situation when possible, since it can break users relying on parallel bootstrap behavior.
I think we could prevent this as following:
1. announce intent to bootstrap via gossip (ie. add node on gossip without token information)
2. wait for gossip to settle for a longer period (ie. ring delay)
3. allocate tokens (if multiple bootstrap attempts are detected, tie break via node-id)
4. broadcast tokens and move on with bootstrap