TOCTOU race

handle_add_member acquires the lock twice sequentially (once for contains_key, once for insert), meaning there's a TOCTOU race between the two lock acquisitions in theory (another task could insert the same key between the two locks)

Locate handle_add_member and inspect how the lock is acquired around contains_key and insert. Confirm the check and insertion cannot be separated by another task, then verify the member-add path under concurrent duplicate requests.

Written by the indexing model from the issue text.