[rudycelekli]

What this changes

Make the concurrent routine-sweep regression exercise the race its assertions describe. The existing Promise.all could let the second sweep read the already advanced firing. Because the fixture dates its rows to 2001 while due eligibility uses Postgres's current clock, that later firing is legitimately still due and the test can report two queue entries.

Both sweeps now finish their real database read of the same firing before either can offer it. The real queue uniqueness and clock compare-and-set remain under test; the spy is restored in finally. No production behavior changes.

Where it runs

• New state that outlives a request? None; the barrier exists only inside one test.
• What happens on the second replica? Production is unchanged. The test deliberately gives both simulated sweepers the same real database snapshot.
• Anything serialised? The test's reads wait at a barrier; production queue uniqueness and clock compare-and-set remain unchanged and independently asserted.
• Anything fanned out to a browser? None.
• New listener, port, or schedule? None.

Boundary and audit

• Every acting call still goes through the existing gateway; no acting code changes.
• No new production refusal or failure; existing audit behavior is unchanged.
• No new client trust.

Changelog

• No changelog entry because only test interleaving changes; a deployment behaves identically.

Proof

Base 743649efc3f21d7bf0badbe6af2bcd5daedd97ce, head 31072c2fa92619918a82080fe6b582d95e0bd672.

• The original test failed during the full suite with two queue entries. Isolated original runs passed, so isolated success alone did not establish the intended interleaving.
• Fixed test: 10/10 repeated runs pass; the entire routine-sweep test file passes (25 tests,129 assertions).
• Independent mutation: making the production firing offer key unique per offer causes this test to fail with two rows. Production source was restored exactly before commit.
• Format, lint, workspace typecheck, test-typecheck baseline guard, and build pass.
• A separate routing candidate on the same upstream base ran full test:ci:11,017 passed,210 skipped,two failed (this routine race and recorder held-steps service-worker timing). Both isolated cases passed on unchanged base and that routing candidate; suite-order/timing causality remains unresolved. The full suite was not rerun on this test-only head and no full green result is claimed.

Tests use a dedicated disposable local Postgres15 database; hosted CI uses Postgres17. No live vendor credentials or application database were used.

AI assistance: implemented and locally validated with OpenAI Codex. Hosted CI and maintainer review remain required.