Advisory file lock at <root>/.secunit.lock. Concurrent invocations against the same root serialise on this lock so state.json writes never interleave.
<root>/.secunit.lock
state.json