Another independent reproduction, in case it helps with reviewing. **Environment**: gnome-keyring 51.1 (Debian package 51.1-3, Debian testing), headless user session (systemd user units, D-Bus session bus, no graphical session). The `login` collection is locked; there is no auto-unlock at login.
**Reproduction**: with the collection locked, start 4 `secret-tool lookup` clients at the same time (or 3 or more `gh auth token` calls, which go through go-keyring's `Unlock`/`Prompt`). **Observed** (identical across prompter variants: `gcr-prompter` absent, `org.gnome.keyring.SystemPrompter` activation pointing at `/bin/false`, and a functional prompter that answers every prompt as cancelled, without opening any window): - one client fails right away (~0.02 s); - the other 3 stay blocked waiting for `Completed`; with an external limit of 150 s, they were still blocked at the limit; - any later client, even alone, also blocks; - `Dismiss` on a stuck prompt is only accepted from the requesting connection, so a third party cannot release it; - restarting the daemon unblocks future clients but not the ones already waiting, because libsecret/go-keyring do not watch for the loss of the `org.freedesktop.secrets` owner. With a single client, the same setup refuses immediately (prompt dismissed, no hang). **Reading of the code** (matches the analysis in this issue): in `daemon/dbus/gkd-secret-unlock.c`, `mark_as_complete` pops the next item and calls `perform_next_unlock(other)`, which sees the queue is not empty and enqueues it again, so no request progresses. The same section is unchanged on `main` when we checked. We would be glad to retest a build with !92 against this scenario. **Downstream mitigation** (for others hitting this in headless sessions): fail-fast guards that refuse before calling the service while the collection is locked, plus an external monitor that restarts the daemon when prompts stay pending for more than a few seconds. This protects future clients only; already blocked clients must be terminated. -- Marcio Teixeira
