Method currentSessionConfig

duckdbservice/activation.go:340–355

()

	p.mu.Unlock()

	// Phase 2 (unlocked): perform the slow I/O. Holding p.mu across this is a
	// bug — RefreshS3Secret runs a CREATE OR REPLACE SECRET which can block
	// indefinitely if the active client query is monopolising a single-conn
	// *sql.DB, and any concurrent health check needs p.mu.RLock to snapshot
	// sessions for stall detection. Releasing the lock here keeps the gRPC
	// health check responsive even when the secret rotation has to wait.
	if needsRefresh {
		if refreshFn == nil {
			refreshFn = server.RefreshS3Secret
		}
		if payload.DuckLake.ObjectStore != "" {
			// The refresh rebuilds the ducklake_s3 secret from this config, so
			// it must carry the same cache-proxy transport (HTTPProxy +
			// USE_SSL=false + pinned endpoint) the attach path applies —
			// otherwise the first CP-driven credential rotation replaces the
			// path-style plain-HTTP secret with a vhost/HTTPS one and every S3
			// read CONNECT-tunnels past the NVMe cache for the rest of the
			// worker's life (mw-prod-us 2026-07-17).
			//