[Server] Session save after every message can overwrite a concurrent worker's update #578

Raised by Copilot on #564 (comment), not caused by it.

Protocol::doProcessInput() saves the whole session after every message, also when the message changed nothing (a notification, a ping, a client response that is dropped). The session is a read-modify-write snapshot without locking, so if another worker stores something in between, e.g. the client's answer to a pending elicitation, this save writes the stale snapshot back and the answer is lost; the waiting fiber then times out.

Skipping the save when nothing changed narrows the window, but the save also refreshes the session's TTL, and any message that does change the session keeps the race. The real fix is a per-session lock or compare-and-swap in the store - the opt-in lock (flock in FileSessionStore, symfony/lock behind PSR-16) proposed in #275 never landed.

Related: #275, #561

🤖 Generated with Claude Code