@quenty/datastore 13.46.1 → 13.47.0

package/CHANGELOG.md

@@ -3,6 +3,16 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [13.47.0](https://github.com/Quenty/NevermoreEngine/compare/@quenty/datastore@13.46.1...@quenty/datastore@13.47.0) (2026-07-23)
+
+### Bug Fixes
+
+- Data store tear down fixes that are graceful ([79152d0](https://github.com/Quenty/NevermoreEngine/commit/79152d03156f2328ab2a4a07bc68e27b5b666775))
+
+### Features
+
+- Even more stuff ([fea7e95](https://github.com/Quenty/NevermoreEngine/commit/fea7e9587e7195bbfa7f4753c130a3d597f9a34b))
+
 ## [13.46.1](https://github.com/Quenty/NevermoreEngine/compare/@quenty/datastore@13.46.0...@quenty/datastore@13.46.1) (2026-07-23)
 
 **Note:** Version bump only for package @quenty/datastore

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quenty/datastore",
-  "version": "13.46.1",
+  "version": "13.47.0",
   "description": "Quenty's Datastore implementation for Roblox",
   "keywords": [
     "Roblox",
@@ -30,26 +30,26 @@
   ],
   "dependencies": {
     "@quenty/baseobject": "10.15.0",
-    "@quenty/bindtocloseservice": "8.36.1",
+    "@quenty/bindtocloseservice": "8.37.0",
     "@quenty/loader": "10.11.0",
     "@quenty/maid": "3.11.0",
     "@quenty/math": "2.7.5",
-    "@quenty/messagingserviceutils": "7.25.0",
+    "@quenty/messagingserviceutils": "7.26.0",
     "@quenty/nevermore-test-runner": "1.5.0",
-    "@quenty/pagesutils": "5.22.0",
-    "@quenty/playermock": "1.1.1",
-    "@quenty/promise": "10.21.0",
-    "@quenty/promisemaid": "5.21.0",
-    "@quenty/rx": "13.31.0",
+    "@quenty/pagesutils": "5.23.0",
+    "@quenty/playermock": "1.2.0",
+    "@quenty/promise": "10.22.0",
+    "@quenty/promisemaid": "5.22.0",
+    "@quenty/rx": "13.32.0",
     "@quenty/servicebag": "11.20.0",
     "@quenty/signal": "7.13.1",
     "@quenty/symbol": "3.5.2",
     "@quenty/table": "3.9.2",
-    "@quenty/valueobject": "13.34.0",
+    "@quenty/valueobject": "13.35.0",
     "@quentystudios/jest-lua": "3.10.0-quenty.2"
   },
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "5ea0583dedebba6492f9ac6d719d32b45c5543fa"
+  "gitHead": "88b03743718172ff79cd62ade64a86565fcac17d"
 }

package/src/Server/DataStore.GracefulClose.spec.lua

@@ -0,0 +1,133 @@
+--!strict
+--[[
+	Covers the graceful session close handoff between two sequential "server sessions" over one
+	DataStoreMock: a session that ends cleanly must release its session lock, so the next server's
+	load is an immediate clean takeover (no graceful-close wait, no retry ladder). Also pins the
+	crash-safety semantics that must NOT change: a live holder still blocks, and a dead holder's
+	fresh lock is only stolen through the retry ladder -- without leaking uncaught rejections.
+
+	@class DataStoreGracefulClose.spec.lua
+]]
+local require = require(script.Parent.loader).load(script)
+
+local DataStoreMock = require("DataStoreMock")
+local DataStoreTestUtils = require("DataStoreTestUtils")
+local Jest = require("Jest")
+local Maid = require("Maid")
+local MessagingServiceMock = require("MessagingServiceMock")
+local PlayerDataStoreManager = require("PlayerDataStoreManager")
+local PromiseTestUtils = require("PromiseTestUtils")
+
+local describe = Jest.Globals.describe
+local expect = Jest.Globals.expect
+local it = Jest.Globals.it
+
+describe("clean session end releases the lock (server-shutdown teardown path)", function()
+	it("manager teardown closes the session so the next server loads immediately", function()
+		local mock = DataStoreMock.new()
+
+		-- Server A: the manager still owns the store at teardown (nothing removed the player
+		-- first), which is exactly what a ServiceBag destroy after a clean session looks like.
+		local maidA = Maid.new()
+		local serviceBagA = DataStoreTestUtils.newServiceBag(maidA, MessagingServiceMock.new())
+		local managerA = maidA:Add(PlayerDataStoreManager.new(serviceBagA, mock :: any, function(userId)
+			return "user_" .. tostring(userId)
+		end, true))
+
+		local storeA = assert(managerA:GetDataStore(1), "No storeA")
+		storeA:Store("coins", 42)
+		if
+			not PromiseTestUtils.awaitValue(function()
+				local raw = mock:GetRaw("user_1")
+				return raw ~= nil and raw.lock ~= nil
+			end, 10)
+		then
+			expect("A never acquired the lock").toEqual("A acquired the lock")
+			maidA:DoCleaning()
+			return
+		end
+
+		-- Clean shutdown: the whole session tears down without the player ever "removing".
+		maidA:DoCleaning()
+
+		-- The teardown flush must write the graceful close: data saved, lock released.
+		expect(PromiseTestUtils.awaitValue(function()
+			local raw = mock:GetRaw("user_1")
+			return raw ~= nil and raw.lock == nil
+		end, 5)).toEqual(true)
+		expect(mock:GetRaw("user_1").coins).toEqual(42)
+
+		-- Server B: an immediate clean takeover -- bounded well under the 5s graceful-close
+		-- wait (and nowhere near the ~49s retry ladder).
+		local maidB = Maid.new()
+		local storeB = DataStoreTestUtils.newSessionLockedStore(maidB, mock, "user_1")
+		local loadB = storeB:Load("coins")
+		if not PromiseTestUtils.awaitSettled(loadB, 1) then
+			expect("B load was not immediate").toEqual("B load was immediate")
+			maidB:DoCleaning()
+			return
+		end
+		expect((loadB:Wait())).toEqual(42)
+		expect(mock:GetRaw("user_1").lock.ActiveSession.SessionId).toEqual(storeB:GetSessionId())
+
+		maidB:DoCleaning()
+	end)
+end)
+
+describe("crash-safety semantics preserved", function()
+	it("still blocks on a live holder that does not close (ask-and-wait, no immediate steal)", function()
+		local controller = DataStoreTestUtils.setup()
+
+		local serverA = controller.newServer({ messaging = true })
+		if not controller.awaitOwn(serverA) then
+			expect("A load hung").toEqual("A load settled")
+			controller:destroy()
+			return
+		end
+
+		local serverB = controller.newServer({ messaging = true })
+		serverB:SetSessionMessagingCloseDelaySeconds(0.1)
+		local loadB = serverB:PromiseLoadSuccessful()
+
+		-- The holder is alive but never closes; B must still be waiting on the graceful
+		-- protocol, not stealing a fresh lock.
+		expect(PromiseTestUtils.awaitSettled(loadB, 2)).toEqual(false)
+		expect(controller.mock:GetRaw("player_1").lock.ActiveSession.SessionId).toEqual(serverA:GetSessionId())
+
+		controller:destroy()
+	end)
+
+	it("steals a dead holder's fresh lock only through the retry ladder, leaking no rejections", function()
+		local controller = DataStoreTestUtils.setup()
+
+		-- A holder that died without closing: fresh lock, no live session behind it. Every
+		-- graceful-close request times out, so the load must grind through the (shortened)
+		-- retry ladder and then steal -- with every rejection along the way consumed (the
+		-- test runner fails the suite on stray uncaught rejections).
+		controller.mock:SetRaw("player_1", {
+			coins = 9,
+			lock = {
+				LastUpdateTime = os.time(),
+				ActiveSession = { SessionId = "dead-session", PlaceId = 123, JobId = "dead-job" },
+			},
+		})
+
+		local serverB = controller.newServer({ messaging = true })
+		serverB:SetLoadRetryOptions({ exponential = 1, initialWaitTime = 0.2, maxAttempts = 2, printWarning = false })
+		serverB:SetSessionMessagingCloseDelaySeconds(0.05)
+
+		local loadB = serverB:PromiseLoadSuccessful()
+		if not PromiseTestUtils.awaitSettled(loadB, 20) then
+			expect("B never stole the dead session's lock").toEqual("B stole the dead session's lock")
+			controller:destroy()
+			return
+		end
+		expect((loadB:Wait())).toEqual(true)
+
+		local raw = controller.mock:GetRaw("player_1")
+		expect(raw.coins).toEqual(9)
+		expect(raw.lock.ActiveSession.SessionId).toEqual(serverB:GetSessionId())
+
+		controller:destroy()
+	end, 30000) -- Two full 5s graceful-close timeouts plus backoff, beyond jest's 5s default
+end)

package/src/Server/DataStore.lua

@@ -673,73 +673,78 @@ function DataStore._promiseGetAsyncNoCache(self: DataStore): Promise.Promise<()>
 			self._maid[loadPromise] = loadPromise
 
 			PromiseMaidUtils.whilePromise(loadPromise, function(maid)
-				maid:GivePromise(
-					DataStorePromises.updateAsync(self._robloxDataStore, self._key, function(data, datastoreKeyInfo)
-						local userIdList = self._userIdList
-						if datastoreKeyInfo then
-							userIdList = datastoreKeyInfo:GetUserIds()
-						end
+				maid
+					:GivePromise(
+						DataStorePromises.updateAsync(self._robloxDataStore, self._key, function(data, datastoreKeyInfo)
+							local userIdList = self._userIdList
+							if datastoreKeyInfo then
+								userIdList = datastoreKeyInfo:GetUserIds()
+							end
 
-						local metadata = nil
-						if datastoreKeyInfo then
-							metadata = datastoreKeyInfo:GetMetadata()
-						end
+							local metadata = nil
+							if datastoreKeyInfo then
+								metadata = datastoreKeyInfo:GetMetadata()
+							end
 
-						if self._debugWriting then
-							print(string.format("DataStorePromises.updateAsync(%q) -> Got ", tostring(self._key)), data)
-						end
+							if self._debugWriting then
+								print(
+									string.format("DataStorePromises.updateAsync(%q) -> Got ", tostring(self._key)),
+									data
+								)
+							end
 
-						local lockResult = self._sessionLockingEnabledHelper:AcquireLock(data, canStealLock)
-						if not lockResult.isValid then
-							if self._sessionMessagingEnabledHelper and tryMessagingServiceSessionClose then
-								-- Gracefully kick to avoid losing memory
-								self._sessionMessagingEnabledHelper
-									:PromiseCloseSessionGraceful(
-										lockResult.blockingSession.PlaceId,
-										lockResult.blockingSession.JobId,
-										lockResult.blockingSession.SessionId
-									)
-									:Then(function()
-										-- Give enough time for Roblox to replicate changes
-										-- We probably could bump back to the loop but this has slightly better error messages
-										return maid:GivePromise(
-											PromiseUtils.delayed(self._sessionMessagingCloseDelaySeconds)
+							local lockResult = self._sessionLockingEnabledHelper:AcquireLock(data, canStealLock)
+							if not lockResult.isValid then
+								if self._sessionMessagingEnabledHelper and tryMessagingServiceSessionClose then
+									-- Gracefully kick to avoid losing memory
+									self._sessionMessagingEnabledHelper
+										:PromiseCloseSessionGraceful(
+											lockResult.blockingSession.PlaceId,
+											lockResult.blockingSession.JobId,
+											lockResult.blockingSession.SessionId
 										)
-									end)
-									:Then(function()
-										return maid:GivePromise(promiseLoadUnlockedProfile(canStealLock, false))
-									end)
-									:Then(function(unlockedProfile)
-										loadPromise:Resolve(unlockedProfile)
-									end, function(err)
-										loadPromise:Reject(
-											`Profile is locked, but gracefully closed. Failed to load with {err}`
+										:Then(function()
+											-- Give enough time for Roblox to replicate changes
+											-- We probably could bump back to the loop but this has slightly better error messages
+											return maid:GivePromise(
+												PromiseUtils.delayed(self._sessionMessagingCloseDelaySeconds)
+											)
+										end)
+										:Then(function()
+											return maid:GivePromise(promiseLoadUnlockedProfile(canStealLock, false))
+										end)
+										:Then(function(unlockedProfile)
+											loadPromise:Resolve(unlockedProfile)
+										end, function(err)
+											loadPromise:Reject(
+												`Profile is locked and the graceful session-close request did not release it. Failed to load with {err}`
+											)
+										end)
+								else
+									loadPromise:Reject(
+										string.format(
+											"Profile is locked (%s)",
+											MessagingServiceUtils.toHumanReadable(data.lock)
 										)
-									end)
-							else
-								loadPromise:Reject(
-									string.format(
-										"Profile is locked (%s)",
-										MessagingServiceUtils.toHumanReadable(data.lock)
 									)
-								)
-							end
+								end
 
-							-- Cancel write to avoid maintaining lock
-							return nil
-						end
+								-- Cancel write to avoid maintaining lock
+								return nil
+							end
 
-						loadPromise:Resolve(lockResult.unlockedProfile)
+							loadPromise:Resolve(lockResult.unlockedProfile)
 
-						return lockResult.lockedProfile, userIdList, metadata
+							return lockResult.lockedProfile, userIdList, metadata
+						end)
+					)
+					:Catch(function(opError)
+						-- The datastore operation itself failed (e.g. 509), which is NOT lock contention and
+						-- will not resolve by retrying. Fail the load fast, preserving the original error.
+						if loadPromise:IsPending() then
+							loadPromise:Reject(DataStoreNonRetryableLoadError.new(opError))
+						end
 					end)
-				):Catch(function(opError)
-					-- The datastore operation itself failed (e.g. 509), which is NOT lock contention and
-					-- will not resolve by retrying. Fail the load fast, preserving the original error.
-					if loadPromise:IsPending() then
-						loadPromise:Reject(DataStoreNonRetryableLoadError.new(opError))
-					end
-				end)
 			end)
 
 			loadPromise:Finally(function()

package/src/Server/DataStoreMessageHelper.lua

@@ -94,6 +94,13 @@ function DataStoreMessageHelper.PromiseCloseSessionGraceful(
 	self._maid[promise] = promise
 	promise:Finally(function()
 		self._maid[promise] = nil
+
+		-- Never cache a settled notification: a timed-out (rejected) promise left in the map would
+		-- make every later request for this session fail instantly instead of sending a fresh
+		-- close request with its own timeout window.
+		if self._sessionClosedNotifications[sessionId] == promise then
+			self._sessionClosedNotifications[sessionId] = nil
+		end
 	end)
 
 	PromiseMaidUtils.whilePromise(promise, function(maid)

package/src/Server/Mocks/DataStoreMock.lua

@@ -276,6 +276,61 @@ function DataStoreMock.GetRaw(self: DataStoreMock, key: string): any
 	return deepCopy(self._store[key])
 end
 
+--[=[
+	Serializes the full raw key -> value store to a JSON string, so a mock's contents can
+	survive between two in-process "server sessions" (e.g. an integration test simulating a
+	cross-place teleport) or be written out as an inspectable, diffable checkpoint artifact.
+	Datastore values are JSON-safe by contract, so the export is lossless; hydrate a fresh
+	mock from it with [DataStoreMock.ImportRaw].
+
+	Errors when the store holds a value that cannot be JSON-encoded (which a real datastore
+	would have refused to store in the first place).
+
+	@return string
+]=]
+function DataStoreMock.ExportRaw(self: DataStoreMock): string
+	local ok, encoded = pcall(function()
+		return HttpService:JSONEncode(self._store)
+	end)
+	if not ok then
+		error(string.format("[DataStoreMock.ExportRaw] - Store contents are not JSON-encodable: %s", tostring(encoded)))
+	end
+
+	return encoded
+end
+
+--[=[
+	Decodes a JSON string produced by [DataStoreMock.ExportRaw] and replaces the store
+	contents with it. This replaces rather than merges: every existing key is discarded,
+	along with its version/userId/metadata bookkeeping. Each imported key is then seeded
+	exactly like [DataStoreMock.SetRaw] (no version bump, no failure injection), so a
+	hydrated mock is indistinguishable from a fresh one seeded key-by-key.
+
+	@param json string
+]=]
+function DataStoreMock.ImportRaw(self: DataStoreMock, json: string): ()
+	assert(type(json) == "string", "Bad json")
+
+	local ok, decoded = pcall(function()
+		return HttpService:JSONDecode(json)
+	end)
+	if not ok then
+		error(string.format("[DataStoreMock.ImportRaw] - Could not decode json: %s", tostring(decoded)))
+	end
+	assert(type(decoded) == "table", "Bad json - expected an encoded key -> value object")
+
+	local store: { [string]: any } = {}
+	for key, value in decoded do
+		assert(type(key) == "string", "Bad json - datastore keys must be strings")
+		store[key] = value
+	end
+
+	self._store = store
+	self._userIds = {}
+	self._metadata = {}
+	self._versions = {}
+end
+
 function DataStoreMock._beginRequest(self: DataStoreMock, method: string, key: string): ()
 	self._callCounts[method] = (self._callCounts[method] or 0) + 1
 	self._totalCalls += 1

package/src/Server/Mocks/DataStoreMock.spec.lua

@@ -1,4 +1,4 @@
---!nonstrict
+--!strict
 --[[
 	Sanity coverage for the DataStoreMock itself, so tests that rely on it can trust its
 	datastore-faithful behavior (deep-copy round-tripping, UpdateAsync transform semantics,
@@ -436,6 +436,125 @@ describe("DataStoreMock serialized-size overflow", function()
 	end)
 end)
 
+describe("DataStoreMock:ExportRaw / ImportRaw", function()
+	it("should round-trip values written through the real datastore APIs", function()
+		local sessionA = DataStoreMock.new()
+		sessionA:SetAsync("player_1", { coins = 5, inventory = { "sword", "shield" } })
+		sessionA:UpdateAsync("player_2", function()
+			return { coins = 12, quests = { active = { "eggHunt" }, completed = {} } }
+		end)
+		sessionA:SetAsync("motd", "Welcome!")
+
+		local json = sessionA:ExportRaw()
+		expect(type(json)).toEqual("string")
+
+		local sessionB = DataStoreMock.new()
+		sessionB:ImportRaw(json)
+
+		expect((sessionB:GetAsync("player_1"))).toEqual({ coins = 5, inventory = { "sword", "shield" } })
+		expect((sessionB:GetAsync("player_2"))).toEqual({
+			coins = 12,
+			quests = { active = { "eggHunt" }, completed = {} },
+		})
+		expect((sessionB:GetAsync("motd"))).toEqual("Welcome!")
+	end)
+
+	it("should hand out a sane keyInfo for imported keys, like a mock seeded via SetRaw", function()
+		local sessionA = DataStoreMock.new()
+		sessionA:SetAsync("key", { coins = 5 })
+		sessionA:SetAsync("key", { coins = 6 }) -- version bumps stay behind, like SetRaw
+
+		local sessionB = DataStoreMock.new()
+		sessionB:ImportRaw(sessionA:ExportRaw())
+
+		local _, keyInfo = sessionB:GetAsync("key")
+		expect(keyInfo).never.toBeNil()
+		expect(keyInfo.Version).toEqual("0")
+		expect(keyInfo:GetUserIds()).toEqual({})
+		expect(keyInfo:GetMetadata()).toEqual({})
+	end)
+
+	it("should replace, not merge, the existing contents on import", function()
+		local source = DataStoreMock.new()
+		source:SetAsync("imported", 1)
+
+		local target = DataStoreMock.new()
+		target:SetAsync("preexisting", "should be discarded")
+		target:SetAsync("imported", "stale value")
+
+		target:ImportRaw(source:ExportRaw())
+
+		expect((target:GetAsync("preexisting"))).toEqual(nil)
+		expect((target:GetAsync("imported"))).toEqual(1)
+	end)
+
+	it("should discard bookkeeping for keys that survive a replace", function()
+		local source = DataStoreMock.new()
+		source:SetAsync("key", 1)
+
+		local target = DataStoreMock.new()
+		target:SetAsync("key", "old", { 111 })
+		target:ImportRaw(source:ExportRaw())
+
+		local _, keyInfo = target:GetAsync("key")
+		expect(keyInfo.Version).toEqual("0")
+		expect(keyInfo:GetUserIds()).toEqual({})
+	end)
+
+	it("should round-trip an empty store", function()
+		local empty = DataStoreMock.new()
+
+		local target = DataStoreMock.new()
+		target:SetAsync("key", "should be discarded")
+		target:ImportRaw(empty:ExportRaw())
+
+		expect((target:GetAsync("key"))).toEqual(nil)
+	end)
+
+	it("should export stably across an import cycle", function()
+		local sessionA = DataStoreMock.new()
+		sessionA:SetAsync("player_1", { coins = 5, nested = { list = { 1, 2, 3 } } })
+		sessionA:SetAsync("player_2", true)
+
+		local firstExport = sessionA:ExportRaw()
+
+		local sessionB = DataStoreMock.new()
+		sessionB:ImportRaw(firstExport)
+		local secondExport = sessionB:ExportRaw()
+
+		-- Key order inside the JSON is not guaranteed, so compare decoded contents.
+		local HttpService = game:GetService("HttpService")
+		expect(HttpService:JSONDecode(secondExport)).toEqual(HttpService:JSONDecode(firstExport))
+	end)
+
+	it("should not alias imported values to later reads", function()
+		local source = DataStoreMock.new()
+		source:SetAsync("key", { coins = 5 })
+
+		local target = DataStoreMock.new()
+		target:ImportRaw(source:ExportRaw())
+
+		local first = target:GetAsync("key")
+		first.coins = 999
+
+		expect((target:GetAsync("key")).coins).toEqual(5)
+	end)
+
+	it("should throw a clear error for malformed json", function()
+		local store = DataStoreMock.new()
+		expect(function()
+			store:ImportRaw("not json {")
+		end).toThrow("Could not decode json")
+	end)
+
+	it("should throw when the json is not an object", function()
+		local store = DataStoreMock.new()
+		expect(function()
+			store:ImportRaw('"just a string"')
+		end).toThrow()
+	end)
+end)
+
 describe("DataStoreMock:SetRaw / GetRaw", function()
 	it("should seed and read without triggering failures", function()
 		local store = DataStoreMock.new()

package/src/Server/PlayerDataStoreManager.lua

@@ -154,21 +154,25 @@ end
 
 --[=[
 	Flushes and tears down every datastore we still own. Runs on manager teardown (a hot-reloaded
-	ServiceBag, or a unit test). Save() is a best-effort synchronous write: the underlying UpdateAsync
-	request is dispatched before Destroy() cancels the promise, so a live server usually honors it, but
-	it is not guaranteed. A store whose load failed rejects, so the rejection is swallowed. Stores handed
-	off gracefully via _removePlayerDataStore have already been pulled out of _datastores, so this only
-	covers the ones nothing else cleaned up.
+	ServiceBag, or a unit test). SaveAndCloseSession() is a best-effort synchronous write: the
+	underlying UpdateAsync request is dispatched before Destroy() cancels the promise, so a live
+	server usually honors it, but it is not guaranteed. A store whose load failed rejects, so the
+	rejection is swallowed. Stores handed off gracefully via _removePlayerDataStore have already been
+	pulled out of _datastores, so this only covers the ones nothing else cleaned up.
 ]=]
 function PlayerDataStoreManager._flushAndDestroyAll(self: PlayerDataStoreManager): ()
 	for userId, datastore in self._datastores do
 		-- Cast past the DataStore intersection type: the solver otherwise blows up ("code too complex")
-		-- resolving :Save()/:Destroy() through it.
+		-- resolving :SaveAndCloseSession()/:Destroy() through it.
 		local store = datastore :: any
-		-- A failed load makes Save() reject unconditionally; skip it so teardown does not
+		-- A failed load makes the save reject unconditionally; skip it so teardown does not
 		-- manufacture a guaranteed rejection.
 		if not store:DidLoadFail() then
-			store:Save()
+			-- Close the session, don't just save: this teardown ends the session, so it must also
+			-- release the session lock. A lock left held here reads as a live foreign session to the
+			-- next server that loads the key, which then grinds through the whole graceful-close/steal
+			-- retry ladder against a holder that no longer exists before it can load.
+			store:SaveAndCloseSession()
 		end
 		store:Destroy()
 		self._datastores[userId] = nil

package/src/Server/PlayerDataStoreManager.spec.lua

@@ -1,4 +1,4 @@
---!nonstrict
+--!strict
 --[[
 	@class PlayerDataStoreManager.spec.lua
 ]]
@@ -225,4 +225,75 @@ describe("PlayerDataStoreManager teardown", function()
 
 		controller:destroy()
 	end)
+
+	it("releases the session lock when destroyed, not just the staged data", function()
+		local controller = DataStoreTestUtils.setupDataStoreManager()
+
+		if not controller.storeAndAwaitLock() then
+			expect("lock was never acquired").toEqual("lock was acquired")
+			controller:destroy()
+			return
+		end
+
+		controller.manager:Destroy()
+
+		expect(PromiseTestUtils.awaitValue(function()
+			local raw = controller.mock:GetRaw("user_1")
+			return raw ~= nil and raw.lock == nil
+		end, 5)).toEqual(true)
+		expect(controller.mock:GetRaw("user_1").coins).toEqual(5)
+
+		controller:destroy()
+	end)
+
+	it("releases the lock for every store it still owns", function()
+		local controller = DataStoreTestUtils.setupDataStoreManager()
+
+		controller.manager:GetDataStore(1):Store("coins", 1)
+		controller.manager:GetDataStore(2):Store("coins", 2)
+
+		local locked = PromiseTestUtils.awaitValue(function()
+			local rawOne = controller.mock:GetRaw("user_1")
+			local rawTwo = controller.mock:GetRaw("user_2")
+			return rawOne ~= nil and rawOne.lock ~= nil and rawTwo ~= nil and rawTwo.lock ~= nil
+		end, 10)
+		if not locked then
+			expect("both locks were never acquired").toEqual("both locks were acquired")
+			controller:destroy()
+			return
+		end
+
+		controller.manager:Destroy()
+
+		expect(PromiseTestUtils.awaitValue(function()
+			local rawOne = controller.mock:GetRaw("user_1")
+			local rawTwo = controller.mock:GetRaw("user_2")
+			return rawOne ~= nil and rawOne.lock == nil and rawTwo ~= nil and rawTwo.lock == nil
+		end, 5)).toEqual(true)
+		expect(controller.mock:GetRaw("user_1").coins).toEqual(1)
+		expect(controller.mock:GetRaw("user_2").coins).toEqual(2)
+
+		controller:destroy()
+	end)
+
+	it("tears down cleanly when a store's load failed, leaking no rejection and writing no lock", function()
+		local controller = DataStoreTestUtils.setupDataStoreManager()
+
+		controller.mock:FailAllRequests()
+
+		local dataStore = controller.manager:GetDataStore(1)
+
+		local loaded = dataStore:PromiseLoadSuccessful()
+		if not expectSettled(loaded, 10) then
+			controller:destroy()
+			return
+		end
+		expect((loaded:Wait())).toEqual(false)
+
+		controller.manager:Destroy()
+
+		expect(controller.mock:GetRaw("user_1")).toBeNil()
+
+		controller:destroy()
+	end)
 end)