I've continued testing:
1) when -service.xml encounters a class-path entry it calls DeploymentInfo.addUrl(), which checks the repository for a deployment and adds the url to the repository.
The problem is that this URL is in the deploy directory, NOT a copy to the tmp directory.
2)if the jar is in the deploy directory, the scanner picks it up and attempts to deploy it. In this case, the MainDeployer makes a copy to the TMP directory and deploys based on the TMP URL.
Subsequently, it complains that 2 jars that have been deployed have the same class file. This also has the unfortunate side affect of locking down the file in the deploy directory.
This sounds like a bug to me.
I had exactly the same problem. I ended up having to put the common jar file in the lib directory (instead of deploy dir) - that seems to work fine.