[ppXD]

Summary

• The stranded-binding repair, the connect-time carry-forward and the departed-member retirement each judge a credential dead and act on that verdict later. A re-authorization (or a provider accepting a refused token again) landing in between left bindings on a credential that was healthy again, or blanked a token the person had just been told was re-authorized.
• Repair and retirement now try-acquire the credential's refresh lock (same semaphore and advisory key as the refresher and re-authorizer, so pods of either build exclude each other). A busy credential is skipped without waiting and met on a later pass; skipping is not a failure and never counts toward the sweep back-off. The dead verdict is re-read under the lock with the same query that picked the candidate, and the successor is the one that verdict names.
• The refresh lock is taken by token writers only, and the hourly health probe revives a refused credential without it. The repair therefore also holds the dead credential's row (FOR NO KEY UPDATE, in a transaction of its own per credential) while it judges and moves, so a verdict recorded since the page was read is seen, and one that arrives later waits for the commit and finds the bindings already moved. The connect path holds the rows it read the same way for its unit of work and drops any whose status or payload changed.
• No schema, API, lock-key or config change. The per-credential transaction is registered in ScopedTransactionInventoryTests as owned by design (a sweep has no transaction to join).

Test plan

• Integration: interleaving tests with the gap made by a command interceptor on the sweep's own context. A re-authorization lands between the candidate read and the move, and bindings stay. A re-authorization arrives while the move is made, waits for the commit and lands after it. The health probe accepts a refused credential before the move, and bindings stay. The health probe arrives while the move is made, and waits for the commit. A busy credential (held by this process or by another pod) is skipped for more passes than the back-off tolerates and is then repaired or retired. A normal stranded credential is still repaired and the lock is given back.
• Mutation checks, each turning tests red: drop the row hold, drop the under-lock re-check, drop the try-lock skip, make a skip count as a failure.
• E2E (CredentialSweepLockE2ETests): a real HTTP reconnect queued behind a lock another pod holds, a repair pass in between, then the next pass; a real departed-member retirement against a held lock.
• Regression: unit suite 14712 passed (1 pre-existing skip); credential/OAuth/sweep integration subset 420 plus 27 sweep-transaction tests passed; credential E2E subset 82 passed.
• Staging: watch credential-binding-repair and departed-credential-retirement logs for "is being written ... stays a candidate" and for deadlock errors on the credential/repository rows after deploy.