@@ -119,6 +119,32 @@ describe('withLeaderLock', () => {
     }
   })
 
+  describe('when the follower wait ends with nothing', () => {
+    const waitedOut = {
+      key: 'k',
+      pollIntervalMs: 5,
+      maxWaitMs: 20,
+      onFollower: async () => null,
+    }
+
+    it('leads once a leader that vanished leaves its lease to lapse', async () => {
+      redisConfigMockFns.mockAcquireLock.mockResolvedValueOnce(false)
+      const onLeader = vi.fn(async () => 'took-over')
+      await expect(withLeaderLock<string>({ ...waitedOut, onLeader })).resolves.toBe('took-over')
+      expect(onLeader).toHaveBeenCalledOnce()
+      expect(redisConfigMockFns.mockAcquireLock).toHaveBeenCalledTimes(2)
+      expect(redisConfigMockFns.mockReleaseLock).toHaveBeenCalledOnce()
+    })
+
+    it('returns the follower result when a live holder still has the lease', async () => {
+      redisConfigMockFns.mockAcquireLock.mockResolvedValue(false)
+      const onLeader = vi.fn(async () => 'should-not-run')
+      await expect(withLeaderLock<string>({ ...waitedOut, onLeader })).resolves.toBeNull()
+      expect(onLeader).not.toHaveBeenCalled()
+      expect(redisConfigMockFns.mockAcquireLock).toHaveBeenCalledTimes(2)
+    })
+  })
+
   it('only one of N concurrent callers acquires the lock', async () => {
     // Track which calls won the lock: first one returns true, rest return false.
     let acquired = false
 
@@ -19,6 +19,13 @@ export interface LeaderLockOptions<T> {
   onFollower: () => Promise<T | null>
 }
 
+/**
+ * Runs `onLeader` in the one caller that takes the lock for `key`; every other caller polls
+ * `onFollower` until it reports the leader's result or `maxWaitMs` passes. A follower whose wait
+ * ends with nothing tries the lock once more: a leader whose process died without releasing it
+ * leaves the lease to lapse, and that follower then leads instead of failing. Losing that try
+ * means a live holder has the lease, and the follower returns `null`.
+ */
 export async function withLeaderLock<T>(opts: LeaderLockOptions<T>): Promise<T | null> {
   const {
     key,
@@ -42,7 +49,7 @@ export async function withLeaderLock<T>(opts: LeaderLockOptions<T>): Promise<T |
     return onLeader()
   }
 
-  if (acquired) {
+  const leadHoldingLock = async () => {
     try {
       return await onLeader()
     } finally {
@@ -57,6 +64,8 @@ export async function withLeaderLock<T>(opts: LeaderLockOptions<T>): Promise<T |
     }
   }
 
+  if (acquired) return leadHoldingLock()
+
   const deadline = Date.now() + maxWaitMs
   while (Date.now() < deadline) {
     await sleep(pollIntervalMs)
@@ -68,6 +77,20 @@ export async function withLeaderLock<T>(opts: LeaderLockOptions<T>): Promise<T |
   const lastChance = await onFollower()
   if (lastChance !== null) return lastChance
 
+  let tookOver = false
+  try {
+    tookOver = await acquireLock(key, ownerToken, ttlSec)
+  } catch (error) {
+    logger.warn('Lock takeover failed after the follower wait', {
+      key,
+      error: toError(error).message,
+    })
+  }
+  if (tookOver) {
+    logger.warn('Follower took over a lease its leader left to lapse', { key, maxWaitMs })
+    return leadHoldingLock()
+  }
+
   logger.warn('Follower timed out waiting for leader', { key, maxWaitMs })
   return null
 }
@@ -601,7 +601,7 @@ describe('OAuth access-token refresh headroom', () => {
     expect(guard).toContain('original-refresh-token')
   })
 
-  /** A Google token with a minute left: the refresh is awaited, and enough validity remains to serve it. */
+  /** A Google token with a minute left, so its caller waits for the refresh instead of using it. */
   const WAITED_GOOGLE_REMAINING_MS = 60_000
 
   it('returns no token when the rotation write finds the account gone', async () => {
@@ -810,62 +810,46 @@ describe('OAuth access-token refresh headroom', () => {
       redisConfigMockFns.mockAcquireLock.mockResolvedValueOnce(false)
     })
 
-    /** Every follower poll, once the lock is contested, reads the unchanged row the caller read. */
-    async function keepChainStoredDuringWait(stored: OAuthAccount) {
-      await vi.waitFor(() => expect(redisConfigMockFns.mockAcquireLock).toHaveBeenCalled())
-      dbChainMockFns.limit.mockResolvedValue([stored])
-    }
-
     it.each([
-      {
-        label: 'serves a Google token still valid after the wait',
-        row: { providerId: 'google-drive', remainingMs: 100_000 },
-        token: 'original-access-token',
-      },
-      {
-        label: 'fails a Google token with under 30 seconds left after the wait',
-        row: { providerId: 'google-drive', remainingMs: 50_000 },
-        token: null,
-      },
-      {
-        label: 'fails a provider whose refresh can invalidate the stored chain',
-        row: { providerId: 'confluence', remainingMs: 100_000 },
-        token: null,
-      },
-    ])('$label', async ({ row, token }) => {
-      const stored = { ...createOAuthAccount(row.remainingMs), providerId: row.providerId }
-      queueCredentialAccount(stored)
+      { label: 'a Google token under the refresh floor', providerId: 'google-drive' },
+      { label: 'a provider that cannot refresh ahead', providerId: 'confluence' },
+    ])('refreshes $label once the follower takes over the lapsed lease', async ({ providerId }) => {
+      queueCredentialAccount({ ...createOAuthAccount(240_000), providerId })
       const pending = resolveCredentialTokenBundle(RAW_CREDENTIAL_ID, RAW_USER_ID, 'test')
-      await keepChainStoredDuringWait(stored)
       await vi.advanceTimersByTimeAsync(31_000)
-      await expect(pending).resolves.toEqual(token === null ? null : { accessToken: token })
+      await expect(pending).resolves.toEqual({ accessToken: 'refreshed-access-token' })
+      expect(mocks.refreshOAuthToken).toHaveBeenCalledOnce()
+    })
+
+    it('never serves the stored token under the refresh floor when a live holder keeps the lease', async () => {
+      redisConfigMockFns.mockAcquireLock.mockResolvedValueOnce(false)
+      queueCredentialAccount(createOAuthAccount(240_000))
+      const pending = resolveCredentialTokenBundle(RAW_CREDENTIAL_ID, RAW_USER_ID, 'test')
+      await vi.advanceTimersByTimeAsync(31_000)
+      await expect(pending).resolves.toBeNull()
       expect(mocks.refreshOAuthToken).not.toHaveBeenCalled()
     })
 
-    it.each([
-      { label: 'the account is deleted', deleted: true, deadCode: null },
-      { label: 'another leader flags it dead', deleted: false, deadCode: 'invalid_client' },
-    ])('fails a valid Google token when $label during the wait', async ({ deleted, deadCode }) => {
-      const stored = createOAuthAccount(100_000)
-      queueCredentialAccount(stored)
+    it('does not refresh again after taking over from a leader that flagged the credential dead', async () => {
+      mocks.getRecentTerminalError
+        .mockResolvedValueOnce(null)
+        .mockResolvedValueOnce('invalid_client')
+      queueCredentialAccount(createOAuthAccount(240_000))
       const pending = resolveCredentialTokenBundle(RAW_CREDENTIAL_ID, RAW_USER_ID, 'test')
-      if (!deleted) await keepChainStoredDuringWait(stored)
-      if (deadCode) mocks.getRecentTerminalError.mockResolvedValue(deadCode)
       await vi.advanceTimersByTimeAsync(31_000)
       await expect(pending).resolves.toBeNull()
+      expect(mocks.refreshOAuthToken).not.toHaveBeenCalled()
     })
 
-    it('lets the follower finish its wait before the in-process refresh times out', async () => {
+    it('lets the follower take over before the in-process refresh times out', async () => {
       const { coalesceLocally } = await vi.importActual<
         typeof import('@/lib/concurrency/singleflight')
       >('@/lib/concurrency/singleflight')
       mocks.coalesceLocally.mockImplementation(coalesceLocally)
-      const stored = createOAuthAccount(100_000)
-      queueCredentialAccount(stored)
+      queueCredentialAccount(createOAuthAccount(240_000))
       const pending = resolveCredentialTokenBundle(RAW_CREDENTIAL_ID, RAW_USER_ID, 'test')
-      await keepChainStoredDuringWait(stored)
       await vi.advanceTimersByTimeAsync(31_000)
-      await expect(pending).resolves.toEqual({ accessToken: 'original-access-token' })
+      await expect(pending).resolves.toEqual({ accessToken: 'refreshed-access-token' })
     })
   })
 
@@ -882,7 +866,7 @@ describe('OAuth access-token refresh headroom', () => {
         settled = true
       }
     )
-    await vi.advanceTimersByTimeAsync(44_000)
+    await vi.advanceTimersByTimeAsync(74_000)
     expect(settled).toBe(false)
     await vi.advanceTimersByTimeAsync(2_000)
     await expect(pending).resolves.toBeNull()
 
@@ -948,23 +948,16 @@ function isRevocationReprobeDue(chain: RevocableChain | null | undefined): boole
   return !revokedAt || Date.now() - revokedAt.getTime() >= REVOKED_REFRESH_REPROBE_INTERVAL_MS
 }
 
-/** What a settled refresh produced: one this process led, or one a follower saw its leader store. */
-type SettledRefreshOutcome =
+/** What one coalesced refresh produced; `null` is a failure worth retrying later. */
+type RefreshOutcome =
   | { kind: 'token'; accessToken: string }
   | { kind: 'revoked'; errorCode: string }
 
-/**
- * What one coalesced refresh produced; `null` is a failure worth retrying later. `lease-held`
- * means this caller followed another lease holder for its whole wait and nothing was stored, while
- * the account still holds the chain the caller read and no leader flagged it dead.
- */
-type RefreshOutcome = SettledRefreshOutcome | { kind: 'lease-held' }
-
-function tokenOutcome(accessToken: string | null): SettledRefreshOutcome | null {
+function tokenOutcome(accessToken: string | null): RefreshOutcome | null {
   return accessToken ? { kind: 'token', accessToken } : null
 }
 
-function revokedOutcome(errorCode: string | null): SettledRefreshOutcome | null {
+function revokedOutcome(errorCode: string | null): RefreshOutcome | null {
   return errorCode ? { kind: 'revoked', errorCode } : null
 }
 
@@ -1022,10 +1015,6 @@ function isOAuthAccessTokenExpiring(
   return expiresAt != null && expiresAt.getTime() <= now.getTime() + refreshWindowMs
 }
 
-function remainingValidityMs(expiresAt: Date, now = new Date()): number {
-  return expiresAt.getTime() - now.getTime()
-}
-
 /**
  * Where a provider can refresh ahead of expiry, a caller is served the stored token with this much
  * validity left or less while a background refresh replaces it. It starts above
@@ -1039,12 +1028,6 @@ const OAUTH_REFRESH_AHEAD_WINDOW_MS = 10 * 60 * 1000
  * the two windows so every account still refreshes ahead before callers have to wait.
  */
 const OAUTH_REFRESH_AHEAD_JITTER_MS = 60 * 1000
-/**
- * The validity a stored token must still have, after a blocking refresh that never settled, to be
- * served instead of failing the request. It sits below {@link OAUTH_ACCESS_TOKEN_REFRESH_WINDOW_MS}
- * on purpose: the request can still use such a token, and its next caller refreshes again.
- */
-const OAUTH_STORED_TOKEN_FALLBACK_MIN_MS = 30 * 1000
 
 /**
  * A Google refresh does not rotate the refresh token, and Microsoft does not revoke the old one
@@ -1106,7 +1089,7 @@ function planAccessTokenRefresh(
   if (
     refreshesAhead &&
     accessTokenExpiresAt &&
-    remainingValidityMs(accessTokenExpiresAt, now) <=
+    accessTokenExpiresAt.getTime() - now.getTime() <=
       OAUTH_REFRESH_AHEAD_WINDOW_MS - refreshAheadJitterMs(accountId)
   ) {
     return { kind: 'refresh-ahead', refreshToken }
@@ -1146,11 +1129,13 @@ const REFRESH_LOCK_HEADROOM_MS = 15_000
 const REFRESH_LOCK_TTL_SEC = Math.ceil((TOKEN_REFRESH_TIMEOUT_MS + REFRESH_LOCK_HEADROOM_MS) / 1000)
 const REFRESH_FOLLOWER_MAX_WAIT_MS = REFRESH_LOCK_TTL_SEC * 1000
 /**
- * How long callers sharing one in-process refresh wait for it: past a follower's full wait (which
- * starts once the lock is contested, and ends with one more read), so a follower concludes on its
- * own; and still bounded, so a leader hung in this process fails its callers instead of wedging them.
+ * How long callers sharing one in-process refresh wait for it: a follower's full wait, then the
+ * leader run it may take over when that wait ends with a lapsed lease (budgeted like any lease),
+ * plus headroom for the lock round trips around them; so a follower concludes on its own, and a
+ * leader hung in this process still fails its callers instead of wedging them.
  */
-const REFRESH_SETTLE_TIMEOUT_MS = REFRESH_FOLLOWER_MAX_WAIT_MS + REFRESH_LOCK_HEADROOM_MS
+const REFRESH_SETTLE_TIMEOUT_MS =
+  REFRESH_FOLLOWER_MAX_WAIT_MS + REFRESH_LOCK_TTL_SEC * 1000 + REFRESH_LOCK_HEADROOM_MS
 
 /**
  * The raw scope one refresh coordinates on: the account row, or the installation for a Slack
@@ -1338,27 +1323,25 @@ async function performCoalescedRefresh({
 
   const refreshPromise = coalesceLocally(
     lockKey,
-    async (): Promise<RefreshOutcome | null> => {
-      let led = false
-      /** The refresh token the follower's latest read found, `undefined` when that read found nothing. */
-      let followerSawRefreshToken: string | null | undefined
-      const outcome = await withLeaderLock<SettledRefreshOutcome>({
+    () =>
+      withLeaderLock<RefreshOutcome>({
         key: lockKey,
         ttlSec: REFRESH_LOCK_TTL_SEC,
         maxWaitMs: REFRESH_FOLLOWER_MAX_WAIT_MS,
         onLeader: async () => {
-          led = true
           try {
             /**
-             * Reread under the lock: another process may have recorded a revocation after the
-             * caller read the row, and the version guards the record against a reconnect that
-             * lands while the provider call is in flight.
+             * Reread under the lock: another process may have recorded a revocation or flagged the
+             * credential dead after the caller read the row (a follower taking over the lock after
+             * a failed leader released it sees only these), and the version guards the record
+             * against a reconnect that lands while the provider call is in flight.
              */
             const current = await readStoredChain(accountId)
             const recordedMeanwhile = recordedRevocationCode(current)
             if (recordedMeanwhile && !isRevocationReprobeDue(current)) {
               return revokedOutcome(recordedMeanwhile)
             }
+            if (await getRecentTerminalError(scopeKey)) return null
             /**
              * A writer that stored a new token after the caller's read (a refresh that finished just
              * before this one took the lock, or a reconnect) already answers it, so this refresh
@@ -1578,7 +1561,6 @@ async function performCoalescedRefresh({
               .from(account)
               .where(eq(account.id, accountId))
               .limit(1)
-            followerSawRefreshToken = row?.refreshToken
             if (
               row?.accessToken &&
               row.accessTokenExpiresAt &&
@@ -1592,24 +1574,14 @@ async function performCoalescedRefresh({
               ? revokedOutcome(revokedByLeader)
               : null
           } catch (error) {
-            followerSawRefreshToken = undefined
             logger.warn('Follower DB read failed during refresh poll', {
               ...logContext,
               ...(privacyMode === 'selector' ? {} : { error: toError(error).message }),
             })
             return null
           }
         },
-      })
-      if (outcome || led) return outcome
-      /**
-       * A follower's wait ran out with nothing stored. That counts against the chain unless the
-       * last read still found the chain this caller read and no leader flagged it dead meanwhile.
-       */
-      const chainStanding =
-        followerSawRefreshToken === refreshToken && !(await getRecentTerminalError(scopeKey))
-      return chainStanding ? { kind: 'lease-held' } : null
-    },
+      }),
     REFRESH_SETTLE_TIMEOUT_MS
   )
 
@@ -1672,21 +1644,8 @@ async function resolveStoredAccessToken(
   if (fresh?.kind === 'token') {
     return { kind: 'token', accessToken: fresh.accessToken, refreshed: true }
   }
-  /**
-   * A refresh ahead abandoned with its process (Trigger.dev runs have no keep-alive) holds its
-   * lease until the TTL, so a follower can wait it out with nothing; a chain that survives
-   * refreshes still serves its stored token if enough validity is left after that wait. Any other
-   * failure (a dead flag, a terminal error, a vanished account) says the chain itself is unusable.
-   */
-  const orphaned =
-    fresh?.kind === 'lease-held' &&
-    refreshesAheadOfExpiry(refresh.providerId) &&
-    stored.accessTokenExpiresAt != null &&
-    remainingValidityMs(stored.accessTokenExpiresAt) > OAUTH_STORED_TOKEN_FALLBACK_MIN_MS
-  if (stored.accessToken && (plan.kind === 'refresh-or-reuse' || orphaned)) {
-    logger.info(
-      `${prefix}${orphaned ? 'Refresh lease still held elsewhere' : 'Refresh unavailable'}; reusing still-valid access token`
-    )
+  if (plan.kind === 'refresh-or-reuse' && stored.accessToken) {
+    logger.info(`${prefix}Refresh unavailable; reusing still-valid access token`)
     return { kind: 'token', accessToken: stored.accessToken, refreshed: false }
   }
   return { kind: 'failed', outcome: fresh }