Clock-skew-resistant conflict resolution

A multi-master, eventually-consistent NoSQL store resolves concurrent writes to the same key with last-writer-wins (LWW) using each node's wall-clock timestamp. In production, a node whose clock was 4 minutes ahead accepted a write; later legitimate writes from correctly-clocked nodes had EARLIER timestamps and were silently discarded by LWW as 'older', so users saw a value revert and stay reverted for minutes. Redesign the conflict-resolution / ordering so that (a) clock skew can't make a stale write win forever, and (b) you can still resolve concurrent writes deterministically across regions. Explain what replaces raw wall-clock timestamps and the precise guarantee you gain, and what LWW fundamentally cannot give you regardless.