sessions.json has no cross-process locking — concurrent instances can still interleave writes

[TMHSDigital]

#54 made persist() merge with the on-disk registry before writing (and write atomically via tmp+rename), which stops one server instance from wholesale clobbering another's records. But there is still no cross-process lock: two instances that read-merge-write at the same moment can interleave, and the last writer's snapshot of a record wins.

Impact today is small (worst case: a status/duration update from one instance is briefly overwritten by another's stale copy), but a proper fix would be one of:

• a lockfile around read-merge-write (e.g. proper-lockfile or an O_EXCL sentinel with retry), or
• per-instance registry files (sessions-<pid>.json) merged on read, so no two processes ever write the same file.

See SessionStore.persist() in src/utils/sessions.ts.

[TMHSDigital]

Correction: #54 was closed as superseded (it was based on 0.2.2). The merge-on-persist + atomic tmp+rename described here landed on main independently via #28 (SessionStore.readDisk()/persist() in src/utils/sessions.ts), so the premise of this issue still holds against current main: the read-merge-write in persist() has no cross-process lock, and two instances writing at the same moment can still interleave, last-writer-wins per record. The proposed fixes (lockfile, or per-instance registry files merged on read) are unchanged.