[pullfrog]

Fixes #14.

What

my-plugin/routes.py performed an unlocked read–merge–write in asyncio.to_thread and wrote straight to <config_dir>/my-plugin.json. Concurrent subset POSTs could overwrite each other's keys, and an interrupted write could leave invalid JSON.

• Serialized updates — an asyncio.Lock is held across the entire read–merge–persist, so overlapping subset updates observe each other's changes instead of clobbering them. Body streaming and schema validation still happen before the lock is taken, and filesystem work still runs off the event loop via asyncio.to_thread.
• Atomic persistence — _write_settings_atomically() writes to a tempfile.mkstemp temporary file in the same directory, flushes + fsyncs it, then os.replaces it onto the destination. A failure at any point unlinks the temp file and leaves the previous configuration byte-identical (the request returns 500).
• Tests — an overlapping-request test fires three concurrent subset POSTs to different keys and asserts all three persist; a failed-write test breaks os.replace and asserts the previous config survives unchanged with no leftover temp file. A sanity harness confirmed the overlapping test loses updates in 20/20 runs when the lock is disabled and passes with it.
• Docs — my-plugin/README.md gains a "Concurrency and durability" section covering the guarantee, the multi-process limitation (per-process lock; cross-process locking needed for multiple workers sharing a config_dir), and the 0600 file mode that mkstemp implies; AGENTS.md and CHANGELOG.md updated to match.

The test fixture now enters TestClient as a context manager so every request shares one event loop — without that, the lock bound to the first request's per-request loop would be rejected by the second.

Verification

• pytest -q — 21 passed (includes the two new tests)
• CI-equivalent checks: manifest assertions, node --check my-plugin/screen.js, print-call grep — all pass

  ^{｜ View workflow run ｜ via Pullfrog ｜ Using big-pickle (free) ｜ 𝕏}

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (6 files)

• AGENTS.md
• CHANGELOG.md
• my-plugin/README.md
• my-plugin/routes.py
• tests/conftest.py
• tests/test_settings_routes.py

---

_{Reviewed by efficient · Input: 32.3K · Output: 10.1K · Cached: 140.7K}