@@ -406,6 +406,28 @@ describe("guardedWrite mutation gaps (epic #1375)", () => {
 			expect(reg.get(abs("doc.txt"))?.version).toBe("v1")
 		})
 
+		it("does not refresh from a token read taken after the lock is released", async () => {
+			const reg = new ObservationRegistry()
+			reg.observe(abs("doc.txt"), "v1", true)
+			const task = createMockTask({ observationRegistry: reg })
+			// Three answers in order: the pre-write comparison, the read this publish makes while it
+			// still holds the lock - which fails here, so nothing is recorded - and the value a read
+			// taken after the release would report, when a peer can have published in the gap.
+			mockedComputeVersionToken
+				.mockResolvedValueOnce("v1")
+				.mockRejectedValueOnce(errno("EIO"))
+				.mockResolvedValue("peer-writer-token")
+			mockedSafeWriteText.mockRejectedValue(new PostCommitDurabilityError(abs("doc.txt"), errno("EIO")))
+
+			await expect(guardedWrite(task, "doc.txt", "patched", "edit")).rejects.toThrow(PostCommitDurabilityError)
+
+			// Two token reads belong to this flow: the comparison and the under-lock read that failed.
+			// The third read is the one taken outside the lock, and its value would stand for a publish
+			// this write never measured, which is the mistake the record under the lock exists to avoid.
+			expect(mockedComputeVersionToken).toHaveBeenCalledTimes(2)
+			expect(reg.get(abs("doc.txt"))?.version).toBe("v1")
+		})
+
 		it("keeps a partial observation partial when a durability failure refreshes it", async () => {
 			const reg = new ObservationRegistry()
 			reg.observe(abs("doc.txt"), "v1", false)
 
@@ -302,5 +302,44 @@ describe("guardedWrite post-check cancellation gaps (epic #1375)", () => {
 			expect(settled.outcome).toBe("published")
 			expect(mockedSafeWriteText).toHaveBeenCalledTimes(1)
 		})
+
+		it("leaves no unhandled rejection when the refusal releases a still-queued chain entry", async () => {
+			// The refusal at guardedWrite.ts line 701 rejects the reserved slot's own work promise while
+			// this write's chain entry is still queued behind the holder's, so the entry has not reached
+			// the await at line 150 yet and the rejected promise has no handler on it. Node's
+			// unhandled-rejection check runs on the current turn, long before the queued turn arrives, so
+			// the handler has to exist at creation rather than when the entry finally runs.
+			const unhandled: string[] = []
+			const listener = (reason: unknown): void => {
+				if (reason instanceof GuardRejectedError && reason.message === CANCELLED) {
+					unhandled.push(reason.message)
+				}
+			}
+			process.on("unhandledRejection", listener)
+			try {
+				const holder = createCancellableTask()
+				const held = guardedWrite(holder.task, "new.txt", "data", "create").catch((error: unknown) => error)
+				await waitUntilOpen()
+
+				const canceller = createCancellableTask()
+				flipOnNextCheck(canceller.abortNow)
+				const answer = recordAnswer(guardedWrite(canceller.task, "new.txt", "data", "create"))
+
+				// Event-loop turns pass here while the holder's publish is still open, which is the window
+				// the check runs in: the queued entry cannot reach its await before the timer fires.
+				await delay(30)
+				expect(unhandled.join(" | ")).toBe("")
+
+				release.open()
+				await held
+				const settled = await answer.settled
+				// The handler must not consume the verdict: this caller still receives the refusal, and the
+				// writer still ran exactly once, for the holder's publish.
+				expect(asGuardRejection((settled as { rejection?: unknown }).rejection).message).toBe(CANCELLED)
+				expect(mockedSafeWriteText).toHaveBeenCalledTimes(1)
+			} finally {
+				process.off("unhandledRejection", listener)
+			}
+		})
 	})
 })
@@ -143,6 +143,13 @@ function reserveChainSlot(pathKey: string): {
 		settle = resolve
 		fail = reject
 	})
+	// The refusal path below releases this reservation while an earlier write still holds the
+	// chain, so the entry under this promise has not reached its await yet and the rejected
+	// promise has no handler on the turn it is rejected on. Node reports that as an unhandled
+	// rejection even though the caller's own promise carries the failure. This handler does not
+	// consume the rejection: the await below still rejects, and settled stays the promise the
+	// caller receives.
+	void held.catch(() => {})
 	// The chain entry opens on its turn and then waits for the work it released, so a later
 	// writer to the same path cannot overtake this one.
 	const settled = enqueue(pathKey, async () => {
@@ -732,8 +739,12 @@ export async function guardedWrite(
 			if (!(error instanceof PostCommitDurabilityError)) {
 				return
 			}
-			const committed =
-				committedTokenFor(error) ?? (await computeVersionToken(absolutePath).catch(() => undefined))
+			// Only a token measured while this write still held the lock may stand for this publish.
+			// A read taken after the release can pick up a peer's newer publish, which is the mistake
+			// the record above exists to avoid, so an unrecorded durability failure leaves the
+			// observation on the token the task was shown rather than moving it to a value this
+			// write never measured.
+			const committed = committedTokenFor(error)
 			if (committed !== undefined) {
 				task.observationRegistry.observe(
 					absolutePath,
 
@@ -288,3 +288,95 @@ test("retakes the lock when the canonical key moves while the callback waits to
 	// become stale.
 	expect(seen).toEqual([aliasPath])
 })
+
+test("propagates a lock-key recheck failure instead of running under a key it could not confirm", async () => {
+	// The re-derivation at fileLock.ts line 206 is what proves the key this call holds is the key a
+	// peer reaching the same file by another spelling is taking. When the inspection itself fails
+	// the canonical key is unknown, and an unknown key is not the same fact as an unchanged key:
+	// canonicalLockPath already refuses to invent a key for exactly this reason on its first call,
+	// and a walk that fails after the lock is held has to refuse on the same rule rather than let
+	// the mutation run under a lock no peer is contending for.
+	vi.mocked(lockfile.lock).mockClear()
+	vi.mocked(fsPromises.readlink).mockClear()
+	vi.mocked(fsPromises.realpath).mockClear()
+	const callerPath = path.join(STORE, "aliasDir", "task.json")
+	const events: string[] = []
+	let inspections = 0
+	vi.mocked(fsPromises.realpath).mockImplementation(async (target: unknown) => {
+		inspections += 1
+		if (inspections > 1) {
+			throw Object.assign(new Error("EACCES: permission denied"), { code: "EACCES" })
+		}
+		return String(target).replace("aliasDir", "realDir")
+	})
+	vi.mocked(lockfile.lock).mockImplementation(async () => {
+		events.push("acquire")
+		return async () => {
+			events.push("release")
+		}
+	})
+
+	let ranCallback = false
+	const thrown = await withFileLock(callerPath, async () => {
+		ranCallback = true
+		events.push("callback")
+	}).catch((error: unknown) => error)
+
+	expect(thrown).toMatchObject({ code: "EACCES" })
+	// Held, then given up: the callback never ran, so nothing mutated under a key whose canonical
+	// form this call could not confirm.
+	expect(events).toEqual(["acquire", "release"])
+	expect(ranCallback).toBe(false)
+})
+
+test("reports a release failure on the retarget path instead of swallowing it", async () => {
+	// The first acquisition below holds the key that goes stale mid-call, and its release now
+	// fails. Dropping that failure means a peer keeps waiting on a lock this call believes it gave
+	// up, with nothing recorded about which key or why. The success path and the error path in this
+	// same function both report a release failure, so the retarget path reporting nothing is an
+	// inconsistency rather than a decision.
+	vi.mocked(lockfile.lock).mockClear()
+	vi.mocked(fsPromises.readlink).mockClear()
+	vi.mocked(fsPromises.realpath).mockClear()
+	const aliasPath = path.join(STORE, "aliasDir", "task.json")
+	let resolvedDir = "realDirOne"
+	let acquisitions = 0
+	const releaseFailure = Object.assign(new Error("EBUSY: lock file still held"), { code: "EBUSY" })
+	const events: string[] = []
+	vi.mocked(fsPromises.realpath).mockImplementation(async (target: unknown) =>
+		String(target).replace("aliasDir", resolvedDir),
+	)
+	vi.mocked(lockfile.lock).mockImplementation(async () => {
+		const acquiredAs = ++acquisitions
+		events.push("acquire:" + acquiredAs)
+		if (acquiredAs === 1) {
+			resolvedDir = "realDirTwo"
+		}
+		return async () => {
+			if (acquiredAs === 1) {
+				events.push("release:1:failed")
+				throw releaseFailure
+			}
+			events.push("release:2")
+		}
+	})
+
+	const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {})
+	const seen: string[] = []
+	await withFileLock(aliasPath, async (absoluteFilePath) => {
+		events.push("callback")
+		seen.push(absoluteFilePath)
+	})
+	const reports = errorSpy.mock.calls.map((call) => String(call[0]))
+	const carried = errorSpy.mock.calls.map((call) => call[1])
+	errorSpy.mockRestore()
+
+	// The retarget still happened and the callback still ran, under the new key.
+	expect(events).toEqual(["acquire:1", "release:1:failed", "acquire:2", "callback", "release:2"])
+	expect(seen).toEqual([aliasPath])
+	// The failure is reported once, naming the key that failed to release, and carrying the error
+	// object itself rather than a paraphrase of it.
+	expect(reports.length).toBe(1)
+	expect(reports[0]).toContain(path.join(STORE, "realDirOne", "task.json"))
+	expect(carried[0]).toBe(releaseFailure)
+})
@@ -203,9 +203,30 @@ export async function withFileLock<T>(
 		// contending for, and a concurrent merge could recreate what the callback deletes. Re-derive
 		// the key under the same rules before running anything, and on a change release, retake the
 		// lock for the new key, and only then run the callback.
-		const currentKey = await canonicalLockPath(operationPath).catch(() => lockKey)
+		// The re-derivation has to answer. A failed inspection leaves the canonical key unknown,
+		// which is not the same fact as an unchanged key: the mutation would run under a lock no
+		// peer reaching the file by its canonical spelling contends for. Give up the lock and
+		// propagate, the same way the first canonicalization above refuses to invent a key.
+		let currentKey: string
+		try {
+			currentKey = await canonicalLockPath(operationPath)
+		} catch (recheckError: unknown) {
+			try {
+				await releaseLock()
+			} catch (releaseError: unknown) {
+				console.error(`Failed to release the lock for ${lockKey} after a failed recheck:`, releaseError)
+			}
+			throw recheckError
+		}
 		if (currentKey !== lockKey) {
-			await releaseLock().catch(() => undefined)
+			// The old key may still be held, so report which key this call could not give up and
+			// carry the failure itself: a peer waiting on that key has to be able to see why the
+			// release did not complete, rather than wait out the staleness timeout unexplained.
+			try {
+				await releaseLock()
+			} catch (releaseError: unknown) {
+				console.error(`Failed to release the lock for ${lockKey} before retargeting:`, releaseError)
+			}
 			if (attempt >= MAX_LOCK_KEY_RETARGETS) {
 				throw new Error(
 					`Lock key for ${operationPath} kept moving across ${MAX_LOCK_KEY_RETARGETS} retargets -- the operation was not run.`,