Fixed

Pending tenant replenishment now runs on the provisioning queue, where the private database worker holds database management credentials. The ordinary scheduler only queues the work. A unique queued job prevents repeated scheduler ticks from adding duplicate replenishment jobs.

When Core requires per-tenant database credentials, direct pending tenant creation without a management connection fails before inserting a tenant record. This prevents repeated empty provisioning records from accumulating.

Upgrade

Restart both ordinary and private provisioning workers after deploying. Configure the same TENANCY_PENDING_COUNT in their application configuration, and ensure the private worker consumes the provisioning queue. Restore a temporarily disabled pool only after that worker is ready. Existing tenants and their data are unchanged; SDK and App versions are unchanged.