server/upload.py: use locking from hadrware.state