fix(agents): release session write lock if fence read throws on prompt release

clawsweeper[bot] · clawsweeper[bot] · commit 394d9784371e · 2026-06-03T11:40:50.000Z
diff --git a/src/agents/embedded-agent-runner/run/attempt.session-lock.test.ts b/src/agents/embedded-agent-runner/run/attempt.session-lock.test.ts
@@ -34,6 +34,7 @@ const lockOptions = {
 const tempDirs: string[] = [];
 
 afterEach(async () => {
+  vi.restoreAllMocks();
   resetEmbeddedAttemptSessionFileOwnersForTest();
   resetSessionWriteLockStateForTest();
   for (const dir of tempDirs.splice(0)) {
@@ -136,7 +137,7 @@ describe("embedded attempt session lock lifecycle", () => {
     expect(releases).toEqual(["held"]);
   });
 
-  it("releases the eagerly-held lock even when the fence read throws during prompt release (FAD-845)", async () => {
+  it("releases the eagerly-held lock when the fence read throws during prompt release", async () => {
     const release = vi.fn(async () => {});
     const acquireSessionWriteLockLocalFad845 = vi.fn(async () => ({ release }));
     const controller = await createEmbeddedAttemptSessionLockController({
@@ -151,14 +152,15 @@ describe("embedded attempt session lock lifecycle", () => {
     const statError = Object.assign(new Error("simulated I/O failure"), { code: "EIO" });
     const statSpy = vi.spyOn(fs, "stat").mockRejectedValueOnce(statError);
 
-    await expect(controller.releaseForPrompt()).rejects.toThrow();
+    try {
+      await expect(controller.releaseForPrompt()).rejects.toThrow();
 
-    // The underlying file lock MUST still be released; otherwise it is orphaned on the
-    // live gateway process for the full maxHoldMs lease (~17 min), wedging every
-    // subsequent interactive turn with SessionWriteLockTimeoutError. See FAD-845.
-    expect(release).toHaveBeenCalledTimes(1);
-
-    statSpy.mockRestore();
+      // The underlying file lock must still be released so later turns do not wait for
+      // the full maxHoldMs watchdog before the stale lease is reclaimed.
+      expect(release).toHaveBeenCalledTimes(1);
+    } finally {
+      statSpy.mockRestore();
+    }
   });
 
   it("releaseHeldLockForAbort and dispose are idempotent in succession (#86816)", async () => {
diff --git a/src/agents/embedded-agent-runner/run/attempt.session-lock.ts b/src/agents/embedded-agent-runner/run/attempt.session-lock.ts
@@ -801,13 +801,9 @@ export async function createEmbeddedAttemptSessionLockController(params: {
       }
       const lock = heldLock;
       heldLock = undefined;
-      // Once `heldLock` is cleared the controller no longer tracks this lock, so the
-      // underlying file lock MUST be released even if the fence bookkeeping below
-      // throws. The fence reads perform filesystem I/O that can fail with a transient
-      // non-ENOENT error (e.g. EIO/EMFILE under load); without this guard such a throw
-      // would orphan the lock on the live gateway process for the full maxHoldMs lease
-      // (~17 min), wedging every subsequent interactive turn with
-      // SessionWriteLockTimeoutError until the watchdog reclaims it. See FAD-845.
+      // Clearing `heldLock` transfers release ownership to this block. Fence reads can
+      // throw after that transfer; release the underlying file lock anyway so later
+      // turns do not wait for the maxHoldMs watchdog.
       try {
         const fingerprint = await readSessionFileFingerprint(params.lockOptions.sessionFile);
         const ownedWrite = ownedSessionFileWrites.get(sessionFileFenceKey);
