While looking at some resharding code for a BF, I noticed there is a clock skew issue with the critical section. When transitioning to blocking writes on the coordinator we persist the time the critical section expires at. Then on failover, with a new server, we re-use that same time to set the critical section abort callback.  I don't think there is any guarantee that the clock times between two servers are similar. So if there is even a 5 second skew between servers, the critical section would abort when it might not have had to or the CS is held longer than expected. 

brettnawrocki@gmail.com suggested that to handle the case where the stored timeout causes the critical section to be longer than expected due to clock skew, we can clamp the critical section deadline to be: 

min(stored timeout deadline, now() + critical section timeout)