- Shipped
- September 4, 2026 at 9:19 PM UTC
- Author
- Kamo
- Commit
- 4bd25e7
Sixteen of SecurityService's seventeen scheduled sweeps have a shared effect and now take a named distributed lease before running. There is no ShedLock anywhere on this platform, so the replica count was what made them correct — this service had the most scheduled work in the fleet and was therefore the most firmly pinned to one pod. The ones worth naming: **************** two pods refreshing the same OAuth grant can invalidate each other's new token and disconnect the calendar BulkExportRunner.pollForWork two pods claiming the same queued rows would run the same EHR/PHI export twice DomainVerificationWatcher flips ownership_verified, which decides which host routes to which org DocReminderSweep sends document reminders to borrowers LeadLockSweeper could release a lock another pod just granted **************** is a @Component nested inside a @Configuration, so it took the lease by hand rather than through the same mechanical edit as the rest. Four tests now exercise the locked body directly (sweepLocked, reverifyConfirmedLocked, pollForWorkLocked). They previously called the scheduled entry point, which now asks a mocked SingletonTaskRunner for a lease it never grants — so every assertion in them would have passed against a body that never ran. In AccessRuleService and OrgObjectStorageSweep the injected field is declared LAST: those use Lombok's @RequiredArgsConstructor, which builds its parameter list in field order, so putting it anywhere else silently reorders the constructor's existing arguments. replicas 1 -> 2. Verified in an isolated worktree off origin/main because this checkout currently carries another session's in-progress OrgNetworkRowBuilder refactor, which does not compile; with only these files applied the service builds and its suite is green apart from two failures that reproduce identically on origin/main (UnauthenticatedEndpointRatchet flags UserAccountController #verifyByToken, which is not part of this change).