I reviewed quickly and it seems that all of the "unsafe" calling functions are holding read locks or greater. @Smjert, in office hours today we wanted to double check this assertion. If this is indeed the case then this looks OK. But we should reconsider the higher level functionality (beyond the Registry internals) to determine what actions should be atomic.

I double checked and I think this looks OK.

I tested this with TSAN and a broad suppressions file:

race:onClientDisconnected
race:/usr/local/osquery-toolchain/usr/bin/../include/c++/v1
race:apache::thrift::server::TConnectedClient::cleanup
race:apache::thrift::server::TServerFramework::disposeConnectedClient
race:apache::thrift::concurrency

So I am not 100% confident but close enough. :)