dashboards: one lock around every dashboard file read-modify-write, a half-failed duplicate rolls its copied sessions back, and the routes reach sibling apps through an injected boundary - #158