Joseph Doherty
16fac72858
Secrets-006: DefaultSecretResolver keeps a per-key invalidation generation; Invalidate bumps it before evicting, and a resolve that read the store under an older generation withdraws its insert, so a rotation mid-resolve is not undone for another TTL. Expired entries are removed on lookup and by a periodic TimeProvider sweep (every TTL, at least 1 s); a non-positive TTL caches nothing. The resolver is now IDisposable (stops the sweep timer). Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV