doesn't this mean that we get the lock in the parent, and we'll actually block even children from running and never let another chef-client run as long a we're daemonized?  or am i confused here?

also, when runlock goes out of scope the GC will eventually it and call the destructor which i think will bubble into the destructor for the filehandle which will release the lock (and will release the lock on any other objects trying to hold the file descriptor open).  i think you want to write a deliberate file descriptor leak and protect it against the GC.