Fixed few memory leaks. Implement testing of the functionality.

CLAUDE.md

@@ -31,10 +31,10 @@ Core concept: Bootstrap with ~19,000 cloud provider IPs → ping targets → tra
 - Race conditions and distributed coordination must be considered for shared resources
 
 ### Current Implementation Status
-- **input_service**: Partially multi-instance ready (per-consumer state is instance-local, which works if clients stick to one instance)
+- **input_service**: Partially multi-instance ready (per-consumer state is instance-local; hop deduplication requires session affinity or broadcast strategy - see MULTI_INSTANCE.md)
 - **ping_service**: Fully multi-instance ready (distributed workers by design)
-- **output_service**: Fully multi-instance ready (each instance maintains its own SQLite database)
-- **manager**: Not multi-instance ready (in-memory sessions, user store reload assumes single instance)
+- **output_service**: Fully multi-instance ready (each instance maintains its own SQLite database with TTL-based sentHops cleanup)
+- **manager**: Requires configuration for multi-instance (in-memory sessions; user store now uses file locking for safe concurrent access - see MULTI_INSTANCE.md)
 
 ## Architecture Components
 
@@ -268,3 +268,20 @@ go run . --add-user=username
 - Output service rotates databases weekly OR at 100MB (whichever first), keeping 5 files
 - Each output_service instance maintains its own database; use `/dump` for central aggregation
 - For multi-instance input_service, use session affinity or call `/hops` on all instances
+
+## Multi-Instance Deployment
+
+All services support multi-instance deployment with varying degrees of readiness. See **MULTI_INSTANCE.md** for comprehensive deployment guidance including:
+- Session affinity strategies for input_service
+- Database aggregation for output_service
+- File locking for manager user store
+- Load balancing recommendations
+- Known limitations and workarounds
+
+## Recent Critical Fixes
+
+- **Fixed panic risk**: input_service now uses `ParseAddr()` with error handling instead of `MustParseAddr()`
+- **Added HTTP timeouts**: ping_service uses 30-second timeout to prevent indefinite hangs
+- **Fixed state serialization**: input_service now preserves activeGens array for proper interleaving after reload
+- **Implemented sentHops eviction**: output_service uses TTL-based cleanup (24h) to prevent unbounded memory growth
+- **Added file locking**: manager user store uses flock for safe concurrent access in multi-instance deployments