Function release_lease_if_current 

pub(super) fn release_lease_if_current(
    block_id: &str,
    inner: &Arc<Mutex<ShellControllerInner>>,
    mstore: &Option<Arc<Store>>,
    event_bus: &Option<Arc<EventBus>>,
) -> bool

Release block_id’s PtyShell agent lease — both copies — but ONLY if inner still identifies the controller currently registered for that block. Returns whether it released.

The guard is the same Arc::ptr_eq controller-identity check the close-on-exit trigger uses, for the same reason (Codex P1 / ReAgent P1 on PR #3249): a force-restart (resync_controller → stop_for_replace) kills this child and registers a REPLACEMENT controller under the same block_id. The killed child’s wait/cleanup task belongs to the OLD controller; without this check it fires afterwards and clears a lease the agent legitimately took on the NEW shell, letting human input race the agent’s writes on a pane that never stopped being driven. Leases are keyed by block_id alone, so a stale task cannot tell its own lease from its successor’s — controller identity is what distinguishes them.

Check-then-act, like its precedent: a replacement registered in the window between the check and the remove would still lose its lease. Same residual race the close-on-exit guard accepts, and self-correcting here, since lock_shell_for_agent re-takes the lease before every agent write.