static LEASE_TMP_COUNTER: AtomicU64
Per-process, monotonically increasing disambiguator folded into lease temp file names, so two calls in the same process racing in the same nanosecond still can’t collide on the temp path.