I should explicitly note that this problem does not occur if:

1. You do not utilize/enable batch fetching
2. The refresh does not locate any other currently lazy entities eligible for batch-fetching
3. You do not specify a lock mode in the refresh
4. You use EntityManager.lock (or the session.buildLockRequest(...)) API followed by a refresh (but this requires two database hits)

I did not ask this in the description, but I question if allowing for batch-fetching to "kick in" when executing for a lock request is in itself already valid?.

By batch fetching rows like this with a for update (or rowlock, etc depending on RDBMS), this means the database is retrieving locks against all rows retrieved - not just the one explicitly specified (which occurs with both EntityManager.refresh with lock and EntityManager.find with lock call).