at least not in common scenarios. i suppose a super short session timeout might lead to that, but that would be pretty irregular

I guess that's really the question, at what point in a request does the session get extended? In any case, I think I may have found the culprit, and it's not this. There's a piece of code I don't like that initializes a struct in session scope, but it doesn't do that atomically. It should create the struct as a local, then set the session var to that local. As of now, it makes a new struct in session scope, then builds the whole thing * in session scope *, which seems like a race condition magnet. Ugh. Old code.

As far as quickly solving the problem - appropriate use of cflocks - should fix this right? Then: you can implement whatever solution works best, validated through testing. (again when writing to shared variables and oftentimes reading from shared variables locks are still required.)