Does anyone else find it interesting that the actual underlying bug causing this data loss is related to what seems to amount to a stateful variable? I.e., the "reference to [a] timer is kept in the updater state", and the actual bug being a process which "never cleared the timer reference".

I think this might suggest an additional criteria for extra code review scrutiny in systems (like CouchDB) that are built in functional langages: any code that "feels" stateful or procedural should probably be examined with additional care, as it is the most likely to contain exactly this classic sort of stateful logic error.