fix: serialize deployment revision writes

src/wf_artifacts/store.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import json
 import re
 from pathlib import Path
+from threading import RLock
 
 from .models import WorkflowArtifact, WorkflowDeployment
 
@@ -65,6 +66,7 @@ class FileWorkflowArtifactStore(WorkflowArtifactStore):
 
     def __init__(self, root: Path) -> None:
         self.root = root
+        self._lock = RLock()
         self.artifacts_dir.mkdir(parents=True, exist_ok=True)
         self.deployments_dir.mkdir(parents=True, exist_ok=True)
 
@@ -111,20 +113,25 @@ class FileWorkflowArtifactStore(WorkflowArtifactStore):
         return self.get_artifact(artifact_id, max(versions))
 
     def save_deployment(self, deployment: WorkflowDeployment) -> None:
-        path = self._deployment_path(deployment.id)
-        if path.exists():
-            existing = WorkflowDeployment.model_validate_json(
-                path.read_text(encoding="utf-8")
+        # Revision advancement is store-owned and must cover the read,
+        # increment, and write as one process-local transition. Callers
+        # intentionally continue sending the existing deployment payload
+        # without a mandatory expected-revision field.
+        with self._lock:
+            path = self._deployment_path(deployment.id)
+            if path.exists():
+                existing = WorkflowDeployment.model_validate_json(
+                    path.read_text(encoding="utf-8")
+                )
+                deployment = deployment.model_copy(
+                    update={"revision": existing.revision + 1}
+                )
+            elif deployment.revision != 1:
+                deployment = deployment.model_copy(update={"revision": 1})
+            path.write_text(
+                json.dumps(deployment.model_dump(mode="json"), indent=2),
+                encoding="utf-8",
             )
-            deployment = deployment.model_copy(
-                update={"revision": existing.revision + 1}
-            )
-        elif deployment.revision != 1:
-            deployment = deployment.model_copy(update={"revision": 1})
-        path.write_text(
-            json.dumps(deployment.model_dump(mode="json"), indent=2),
-            encoding="utf-8",
-        )
 
     def get_deployment(self, deployment_id: str) -> WorkflowDeployment:
         path = self._deployment_path(deployment_id)