The clearest writeup of this race I've read — "every request in the web group is a writer" is the sentence that makes the whole thing click.

One caveat I'd add to your honest-details list: never put this middleware on a route that regenerates or invalidates the session. logout() calls $this->session->invalidate(), which destroys the old session row and writes a fresh empty one — with the NullSessionHandler, both the destroy and the write are discarded. The browser gets the new session cookie, but the old session stays valid server-side for its full lifetime. Logout would look successful while the session quietly survives.

Same applies anywhere you call regenerate(). The middleware is strictly for read-only routes; anything that mutates session identity needs the real handler. Worth a line in the post, because "apply it broadly to stop races" is the tempting misreading.