release

Releases the lock. Must run even on failure, so callers use try/finally.