NebulaGraph 3.8.0 regression: concurrent authentication fails with “Insert session to local cache failed” due to duplicate session IDs

Root cause evidence

This appears to be the session-ID collision fixed by #5916.

In NebulaGraph 3.6.0, CreateSessionProcessor held LockUtils::sessionLock() while generating a session ID from fastNowInMicroSec(). This serialized session creation.

PR #5762 removed that lock to improve session-creation performance under high concurrency. NebulaGraph 3.8.0 still generates the session ID from fastNowInMicroSec(), but now does so before the RocksDB atomic operation.

Consequently, two requests arriving within the same microsecond can receive the same session ID. The atomic operation does not make the already-generated ID unique.

When graphd tries to add both sessions to its activeSessions_ cache, the second insertion fails with:

Insert session to local cache failed.

Discussion #5901 describes this same failure mode.

PR #5916, merged as commit c078c6c, changed session-ID generation from a microsecond timestamp to a random nonzero 64-bit value specifically to prevent duplicate IDs during highly concurrent session creation.

However, that correction does not appear to be present in either the v3.8.0 tag or the release-3.8 branch.

Requested maintainer action

1. Please confirm that #5916 is the intended correction for this failure.
2. Please backport c078c6c to release-3.8 and publish patched server images.
3. Please identify any existing official image or tag that already contains the correction.
4. If no corrected release exists, please document the supported workaround for NebulaGraph 3.8.0 users.