@@ -0,0 +1,50 @@
+import { flushMacrotask } from '@sim/testing/helpers/async'
+import { createDeferred } from '@sim/testing/helpers/deferred'
+import { describe, expect, it } from 'vitest'
+import { createConcurrencyLimit } from '@/lib/core/utils/concurrency'
+
+describe('createConcurrencyLimit', () => {
+  it('runs at most the limit at once and starts waiting tasks in call order', async () => {
+    const limit = createConcurrencyLimit(2)
+    const gates = Array.from({ length: 5 }, () => createDeferred<void>())
+    const started: number[] = []
+    let active = 0
+    let peak = 0
+    const runs = gates.map((gate, index) =>
+      limit(async () => {
+        started.push(index)
+        peak = Math.max(peak, ++active)
+        await gate.promise
+        active--
+        return index
+      })
+    )
+    await flushMacrotask()
+    expect(started).toEqual([0, 1])
+    for (const index of [1, 0, 4, 3, 2]) {
+      gates[index].resolve()
+      await flushMacrotask()
+    }
+    await expect(Promise.all(runs)).resolves.toEqual([0, 1, 2, 3, 4])
+    expect(started).toEqual([0, 1, 2, 3, 4])
+    expect(peak).toBe(2)
+  })
+
+  it('releases the slot of a task that throws synchronously or rejects', async () => {
+    const limit = createConcurrencyLimit(1)
+    const error = new Error('task failed')
+    const throwsSynchronously = (): Promise<never> => {
+      throw error
+    }
+    const thrown = limit(throwsSynchronously)
+    const rejected = limit(async () => Promise.reject(error))
+    let next: string | undefined
+    void limit(async () => 'next').then((value) => {
+      next = value
+    })
+    await expect(thrown).rejects.toBe(error)
+    await expect(rejected).rejects.toBe(error)
+    await flushMacrotask()
+    expect(next).toBe('next')
+  })
+})
@@ -148,6 +148,8 @@ const FAILURE_REASONS = [
   'mcp_payload_too_large',
   'mcp_payload_unreadable',
   'mcp_account_required',
+  /** The account never got to search: no slot freed with enough of the search deadline left. */
+  'not_started',
 ] as const
 export type SearchFailureReason = (typeof FAILURE_REASONS)[number]
 
 
@@ -9,6 +9,7 @@ import {
 } from '@sim/testing'
 import { encryptionMock, encryptionMockFns } from '@sim/testing/mocks/encryption.mock'
 import { getMockLogger } from '@sim/testing/mocks/logger.mock'
+import { redisConfigMockFns } from '@sim/testing/mocks/redis-config.mock'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const hoisted = vi.hoisted(() => ({
@@ -71,6 +72,7 @@ vi.mock('@/lib/oauth/refresh-error-codes', () => ({
   isTerminalRefreshError: vi.fn(() => false),
 }))
 
+import { CredentialRevokedError } from '@/lib/oauth/credential-revoked'
 import {
   getCredentialTerminalRefreshError,
   getOAuthToken,
@@ -83,7 +85,10 @@ import {
 import { isInstagramProvider, shouldProactivelyRefreshInstagramToken } from '@/lib/oauth/instagram'
 import { isMicrosoftProvider } from '@/lib/oauth/microsoft'
 import { getOAuthRefreshCoordinationIdentity } from '@/lib/oauth/refresh-coordination'
-import { isTerminalRefreshError } from '@/lib/oauth/refresh-error-codes'
+import {
+  isCredentialRevocationError,
+  isTerminalRefreshError,
+} from '@/lib/oauth/refresh-error-codes'
 import { fanOutSlackTokenChain } from '@/lib/oauth/slack'
 import { markCredentialDead } from '@/lib/oauth/terminal-errors'
 import { GOOGLE_SERVICE_ACCOUNT_PROVIDER_ID } from '@/lib/oauth/types'
@@ -434,6 +439,7 @@ describe('OAuth access-token refresh headroom', () => {
   afterEach(() => {
     vi.useRealTimers()
     vi.mocked(isTerminalRefreshError).mockReturnValue(false)
+    vi.mocked(isCredentialRevocationError).mockReturnValue(false)
     vi.mocked(isInstagramProvider).mockReturnValue(false)
     vi.mocked(shouldProactivelyRefreshInstagramToken).mockReturnValue(false)
     vi.mocked(isMicrosoftProvider).mockReturnValue(false)
@@ -783,6 +789,98 @@ describe('OAuth access-token refresh headroom', () => {
     await expect(concurrent).resolves.toEqual({ accessToken: 'refreshed-access-token' })
     expect(mocks.refreshOAuthToken).toHaveBeenCalledOnce()
   })
+  describe('when a refresh lease is held by a refresh no process is running', () => {
+    beforeEach(async () => {
+      const { withLeaderLock } = await vi.importActual<
+        typeof import('@/lib/concurrency/leader-lock')
+      >('@/lib/concurrency/leader-lock')
+      mocks.withLeaderLock.mockImplementation(withLeaderLock)
+      redisConfigMockFns.mockAcquireLock.mockResolvedValueOnce(false)
+    })
+
+    it.each([
+      {
+        label: 'serves a Google token still valid after the wait',
+        row: { providerId: 'google-drive', remainingMs: 100_000 },
+        token: 'original-access-token',
+      },
+      {
+        label: 'fails a Google token with under 30 seconds left after the wait',
+        row: { providerId: 'google-drive', remainingMs: 50_000 },
+        token: null,
+      },
+      {
+        label: 'fails a provider whose refresh can invalidate the stored chain',
+        row: { providerId: 'confluence', remainingMs: 100_000 },
+        token: null,
+      },
+    ])('$label', async ({ row, token }) => {
+      queueCredentialAccount({ ...createOAuthAccount(row.remainingMs), providerId: row.providerId })
+      const pending = resolveCredentialTokenBundle(RAW_CREDENTIAL_ID, RAW_USER_ID, 'test')
+      await vi.advanceTimersByTimeAsync(31_000)
+      await expect(pending).resolves.toEqual(token === null ? null : { accessToken: token })
+      expect(mocks.refreshOAuthToken).not.toHaveBeenCalled()
+    })
+  })
+
+  it('fails a Google chain the provider revokes even while its access token is valid', async () => {
+    vi.mocked(isTerminalRefreshError).mockReturnValue(true)
+    vi.mocked(isCredentialRevocationError).mockReturnValue(true)
+    mocks.refreshOAuthToken.mockResolvedValue({ ok: false, errorCode: 'invalid_grant' })
+    const row = createOAuthAccount(100_000)
+    queueTableRows(account, [row])
+    queueTableRows(account, [row])
+    await expect(refreshTokenIfNeeded('test', row, RAW_ACCOUNT_ID)).rejects.toBeInstanceOf(
+      CredentialRevokedError
+    )
+    expect(dbChainMockFns.set).toHaveBeenCalledWith(
+      expect.objectContaining({ refreshRevokedCode: 'invalid_grant' })
+    )
+  })
+
+  it('answers a Microsoft caller from its valid token while refresh-token aging refreshes', async () => {
+    vi.mocked(isMicrosoftProvider).mockReturnValue(true)
+    const provider = createDeferred<unknown>()
+    mocks.refreshOAuthToken.mockReturnValue(provider.promise)
+    const row = {
+      ...createOAuthAccount(3_600_000),
+      providerId: 'microsoft-teams',
+      refreshTokenExpiresAt: new Date(now.getTime() + 24 * 60 * 60_000),
+    }
+    await expect(refreshTokenIfNeeded('test', row, RAW_ACCOUNT_ID)).resolves.toEqual({
+      accessToken: 'original-access-token',
+      refreshed: false,
+    })
+    await vi.waitFor(() => expect(mocks.refreshOAuthToken).toHaveBeenCalledOnce())
+    expect(dbChainMockFns.set).not.toHaveBeenCalled()
+    provider.resolve({
+      ok: true,
+      accessToken: 'refreshed-access-token',
+      refreshToken: 'rotated-refresh-token',
+      expiresIn: 3600,
+    })
+    await vi.waitFor(() =>
+      expect(dbChainMockFns.set).toHaveBeenCalledWith(
+        expect.objectContaining({ accessToken: 'refreshed-access-token' })
+      )
+    )
+  })
+
+  it('spreads refresh-ahead start across accounts expiring at the same moment', async () => {
+    const row = createOAuthAccount(270_000)
+    /** Chosen because their hashes fall on opposite sides of the 30s jitter cut, so a hash-rule change fails loudly. */
+    await expect(refreshTokenIfNeeded('test', row, 'account-2')).resolves.toEqual({
+      accessToken: 'original-access-token',
+      refreshed: false,
+    })
+    await vi.waitFor(() => expect(mocks.refreshOAuthToken).toHaveBeenCalledOnce())
+    await expect(refreshTokenIfNeeded('test', row, 'account-c')).resolves.toEqual({
+      accessToken: 'original-access-token',
+      refreshed: false,
+    })
+    await flushMicrotasks(20)
+    expect(mocks.refreshOAuthToken).toHaveBeenCalledOnce()
+  })
 })
 
 describe('Google service-account token minting', () => {
@@ -797,7 +895,11 @@ describe('Google service-account token minting', () => {
   const driveScope = 'https://www.googleapis.com/auth/drive.readonly'
   const now = new Date('2026-09-09T18:00:00.000Z')
 
-  beforeEach(() => {
+  beforeEach(async () => {
+    const { coalesceLocally } = await vi.importActual<
+      typeof import('@/lib/concurrency/singleflight')
+    >('@/lib/concurrency/singleflight')
+    mocks.coalesceLocally.mockImplementation(coalesceLocally)
     resetDbChainMock()
     vi.useFakeTimers()
     vi.setSystemTime(now)
@@ -896,6 +998,19 @@ describe('Google service-account token minting', () => {
     expect(fetchMock).toHaveBeenCalledTimes(1)
   })
 
+  it('shares one key read across concurrent mints', async () => {
+    queueTableRows(credential, [row])
+    await expect(
+      Promise.all(
+        Array.from({ length: 6 }, (_, index) =>
+          getServiceAccountToken('credential-1', [driveScope], `member-${index}@example.com`)
+        )
+      )
+    ).resolves.toEqual(Array(6).fill('google-access-token'))
+    expect(dbChainMockFns.select).toHaveBeenCalledTimes(1)
+    expect(fetchMock).toHaveBeenCalledTimes(6)
+  })
+
   it('preserves cancellation through the service-account resolver registry', async () => {
     const controller = new AbortController()
     const reason = new DOMException('Caller cancelled', 'AbortError')
 
@@ -225,6 +225,38 @@ const SA_DIAGNOSTIC_ERROR_CODES = new Set([
   'unauthorized_client',
 ])
 
+/**
+ * The decrypted key of a live Google service-account credential. Reads running at once (one per
+ * delegated subject) share one query and decrypt; a later read queries again, so it sees a
+ * revocation recorded since.
+ */
+function readGoogleServiceAccountKey(credentialId: string): Promise<string> {
+  return coalesceLocally(`sa-key:${credentialId}`, async () => {
+    const [credentialRow] = await db
+      .select({
+        type: credential.type,
+        providerId: credential.providerId,
+        revokedAt: credential.revokedAt,
+        encryptedServiceAccountKey: credential.encryptedServiceAccountKey,
+      })
+      .from(credential)
+      .where(eq(credential.id, credentialId))
+      .limit(1)
+
+    if (
+      credentialRow?.type !== 'service_account' ||
+      credentialRow.providerId !== GOOGLE_SERVICE_ACCOUNT_PROVIDER_ID ||
+      credentialRow.revokedAt !== null ||
+      !credentialRow.encryptedServiceAccountKey
+    ) {
+      throw new Error('Google service account credential is unavailable')
+    }
+
+    const { decrypted } = await decryptSecret(credentialRow.encryptedServiceAccountKey)
+    return decrypted
+  })
+}
+
 /**
  * Generates a short-lived access token for a Google service account credential
  * using the two-legged OAuth JWT flow (RFC 7523).
@@ -241,27 +273,7 @@ export async function getServiceAccountToken(
   options?: CredentialTokenResolutionOptions
 ): Promise<string> {
   options?.signal?.throwIfAborted()
-  const [credentialRow] = await db
-    .select({
-      type: credential.type,
-      providerId: credential.providerId,
-      revokedAt: credential.revokedAt,
-      encryptedServiceAccountKey: credential.encryptedServiceAccountKey,
-    })
-    .from(credential)
-    .where(eq(credential.id, credentialId))
-    .limit(1)
-
-  if (
-    credentialRow?.type !== 'service_account' ||
-    credentialRow.providerId !== GOOGLE_SERVICE_ACCOUNT_PROVIDER_ID ||
-    credentialRow.revokedAt !== null ||
-    !credentialRow.encryptedServiceAccountKey
-  ) {
-    throw new Error('Google service account credential is unavailable')
-  }
-
-  const { decrypted } = await decryptSecret(credentialRow.encryptedServiceAccountKey)
+  const decrypted = await readGoogleServiceAccountKey(credentialId)
   const keyData = JSON.parse(decrypted) as {
     client_email: string
     private_key: string
@@ -1003,6 +1015,10 @@ function isOAuthAccessTokenExpiring(
   return expiresAt != null && expiresAt.getTime() <= now.getTime() + refreshWindowMs
 }
 
+function remainingValidityMs(expiresAt: Date, now = new Date()): number {
+  return expiresAt.getTime() - now.getTime()
+}
+
 /**
  * Where a provider can refresh ahead of expiry, a caller is served the stored token with this much
  * validity left or less while a background refresh replaces it. It starts above
@@ -1016,12 +1032,16 @@ const OAUTH_REFRESH_AHEAD_WINDOW_MS = 10 * 60 * 1000
  * the two windows so every account still refreshes ahead before callers have to wait.
  */
 const OAUTH_REFRESH_AHEAD_JITTER_MS = 60 * 1000
+/**
+ * The validity a stored token must still have, after a failed blocking refresh, to be served
+ * instead of failing the request.
+ */
+const OAUTH_STORED_TOKEN_FALLBACK_MIN_MS = 30 * 1000
 
 /**
- * Google and Microsoft keep a refreshed-away access token valid until its own expiry and keep the
- * old refresh token usable (Google never rotates it; Microsoft rotates without revoking the old
- * one), so a caller can use the old token while the refresh runs and an abandoned refresh loses
- * nothing.
+ * A Google refresh does not rotate the refresh token, and Microsoft does not revoke the old one
+ * when issuing a new one (learn.microsoft.com, "Refresh tokens in the Microsoft identity
+ * platform"); serving the stored access token meanwhile relies on it staying valid until expiry.
  */
 function refreshesAheadOfExpiry(providerId: string): boolean {
   return (
@@ -1077,7 +1097,7 @@ function planAccessTokenRefresh(
   if (
     refreshesAhead &&
     accessTokenExpiresAt &&
-    accessTokenExpiresAt.getTime() - now.getTime() <=
+    remainingValidityMs(accessTokenExpiresAt, now) <=
       OAUTH_REFRESH_AHEAD_WINDOW_MS - refreshAheadJitterMs(accountId)
   ) {
     return { kind: 'refresh-ahead', refreshToken }
@@ -1616,8 +1636,20 @@ async function resolveStoredAccessToken(
   if (fresh?.kind === 'token') {
     return { kind: 'token', accessToken: fresh.accessToken, refreshed: true }
   }
-  if (plan.kind === 'refresh-or-reuse' && stored.accessToken) {
-    logger.info(`${prefix}Refresh unavailable; reusing still-valid access token`)
+  /**
+   * A refresh ahead abandoned with its process (Trigger.dev runs have no keep-alive) holds its
+   * lease until the TTL, so a follower can wait it out with nothing; a chain that survives
+   * refreshes still serves its stored token if enough validity is left after that wait.
+   */
+  const orphaned =
+    fresh === null &&
+    refreshesAheadOfExpiry(refresh.providerId) &&
+    stored.accessTokenExpiresAt != null &&
+    remainingValidityMs(stored.accessTokenExpiresAt) > OAUTH_STORED_TOKEN_FALLBACK_MIN_MS
+  if (stored.accessToken && (plan.kind === 'refresh-or-reuse' || orphaned)) {
+    logger.info(
+      `${prefix}${orphaned ? 'Refresh produced no token' : 'Refresh unavailable'}; reusing still-valid access token`
+    )
     return { kind: 'token', accessToken: stored.accessToken, refreshed: false }
   }
   return { kind: 'failed', outcome: fresh }