As far as I can tell the make-fresh-user-module procedure is not called by guile itself, and providing a global mutex for it with a binding enabling it to be called from scheme code seems to work fine.
This also makes it straightforward to incorporate in a thread-safe way the code you suggested to free stale user modules. However, as I mentioned, I am a bit reluctant to incorporate code which might break in the future. Is there any possibility that a "delete-module!" procedure could be included within the public guile API for the next release of guile? It seems like something that could be useful to anyone using non-default user modules in their code. Chris