Your problem most likely is that you're using several CGI::Session objects in one run of the program. Every time you do

my $session = CGI::Session->load($sessionid);
[download]

a new session object (but not a new session/ID) is created, which will autoflush its data when it goes out of scope. If you maintain several CGI::Session objects (and thus separate in-memory representations of the session data) in one run of the program, the one that goes out of scope last will "win", as it overwrites (on-disk) any changes that may have been flushed before...

Your $session object that you created in between the "MARKING" comments is file-scope and will thus not go out of scope before the CGI terminates. The other one created within AddMessage() will go out of scope at the end of the subroutine. In other words, the file-scoped one wins, as it writes to disk later.

Try putting an explicit $session->flush() after "MARKING 3", or put an extra { ... } block around the "MARKING" section, and you should see different behaviour, i.e. in this case, the stuff added in AddMessage() will be flushed later.