The symptom was a backup that finished twice some mornings, leaving two near-identical snapshots minutes apart. No errors, no warnings, just the occasional duplicate. The kind of bug that is easy to ignore until it is filling a disk.
I assumed overlap: the job running long enough that the next tick started before the last one finished. So I added a flock, felt clever, and watched it happen again the next week. Two runs, three minutes apart. Flock does nothing when the two runs do not actually overlap in time.
The real cause was embarrassing and entirely my own. The entry lived in /etc/cron.d/backups, and a config-management run had once appended it without de-duplicating, so there were two identical lines. Most nights cron collapsed them in my head but not in reality: both fired, the second simply found the lock free again moments later. grep -c backup /etc/cron.d/backups returned 2. That was the whole mystery.
0 3 * * * root /usr/local/bin/backup.sh
0 3 * * * root /usr/local/bin/backup.sh
The lesson I keep relearning: when something runs twice, count the triggers before you theorise about timing. The cause is far more often two entries than one clever race. And put your scheduled jobs under config management that actually owns the file, not one that appends to it.