box.watch('box.status') fires on more than ro flips (status transitions, election term bumps, replica connect) — so any DESTRUCTIVE once-per-promotion work in its callback must be edge-guarded (track previous box.info.ro, run only on the RO->RW transition). Idempotent calls (schema.init, lease.start_expiry) are fine unconditionally. Concrete case: lease.rebuild_deadlines resets every lease deadline to now+ttl; running it on every RW callback would keep refreshing live leases so they never expire. Guard is in app/roles/etcd.lua status_watcher (bd-3sp). Verified disk bench after the keep-alive WAL fix on work.lab.local: LeaseKeepAlive 6021-6327 ops/s (was ~207), p50 142-152us (was 4550us).