bug: send_message fire-and-forget TOCTOU race

[csmith49]

Problem

EventService.send_message checks execution_status != RUNNING then creates a fire-and-forget task to run the conversation, without holding the _run_lock. If two messages arrive simultaneously, both can pass the status check and start parallel runs of the same conversation.

Location: event_service.py:389–400

Evidence

Code review. The comment in the code says the task is "intentionally not tracked."

Severity: High

Impact of fix

Prevents double-execution of conversations.

Fix

Hold _run_lock around the status check and task creation, matching the pattern used in the explicit run() endpoint.

Related issues and PRs

• Alternate fix for conversations that stop responding due to stale execution status  #2470 — Alternate fix for conversations that stop responding due to stale execution status (open PR, related execution status race)
• Fixes conversations that stop responding due to stale execution status #2466 — Fixes conversations that stop responding due to stale execution status (closed PR)

Discovered during profiling investigation (code review), May 2026. openhands-agent-server v1.19.1.