I haven't seen this yet in practice, but I think the following is a bug:
- Clients currently only renew leases to the active NN
- Leases are written into the log when created, but there is no record to renew them
- In Standby state, we don't check leases for expiration. But, when we fail over and start the lease monitor, since the leases haven't been renewed, they might end up getting incorrectly released.