Lightning Network: tricking a node to cancel transaction with revocation & money loss

Question

After reading about Lightning Networks in this and similar articles, I realized that I don't understand how the protocol & the system prevents the following scenario:

1. There is an established channel between Alice & Bob.
2. The transaction outputs of the latest 'agreed' off-chain transaction are 1BC on Alice's side and 1 BC on Bob's side.
3. Alice & Bob initiate a new transaction.
4. Alice & Bob exchange their parts of revocation keys.
5. Bob decides to cheat and pretends to "disappear", not signing the new transaction and not responding, but still being online and monitoring on-chain transactions.
6. At some point in time, if Alice wants to free up her 1 bitcoin, she executes latest 'agreed' transaction, but her funds are locked for 2 weeks.
7. While pretending to be unresponsive, Bob is monitoring the chain and executes the revocation clause as soon as it happens, getting both bitcoins.

Obviously, significant time may pass between #5 and #6, but if Bob can afford to wait, he can pull that trick.

It seems that in order to avoid that, new off-chain transactions need to be signed in a single distributed transaction with the exchange of revocation keys, but I don't see how it is feasible. I've read multiple mentions that the keys are exchanged prior to signing new transactions.

I've read a similar question here, but I don't think it really addresses the situation I've described.

What am I missing?

Answer 1

You touch a point that is a bit subtle but never the less no problem. I have explained it step by step in the channel operation chapter: https://github.com/lnbook/lnbook/blob/develop/09_channel_operation.asciidoc

TL;DR: While changing the balance of a channel Alice does only revoke her tx and state after she has received signatures for the new state from Bob. Thus if Bob becomes unresponsive during the process and alice dies not have new signatures yet it is save for her to force close with the latest state for which she does have the signatures (as that state has not been revoked yet)

While moving forward the balance for a short moment each side of the channel temporarily has two fully signed but unrevoked commitment transactions. This is secure though as publishing the "old" state is not wrong while the new one is not fully agreed upon.