Module lock 

Per-run advisory flock primitive (design.md §4).

The lock is also the source of a compile-time witness, LockedRun, that the run’s exclusive lock is held. The unlocked event-append entry points (crate::append_and_apply_unlocked and friends) take a &LockedRun parameter, so the type system — not a “the caller must hold the lock” doc comment — proves a writer holds the flock before it appends. Only the exclusive guard mints a witness (RunLock::witness); a shared (LOCK_SH) reader has no write capability and cannot produce one, because RunLock is a typestate generic (Exclusive vs Shared) and witness exists only on RunLock<Exclusive>.

Structs

LockedRun

Compile-time proof that the holder is inside a critical section guarded by the run’s exclusive flock.

RunLock

RAII guard holding the run’s flock.

Enums

Exclusive

Typestate marker: the exclusive (LOCK_EX) lock. A RunLock<Exclusive> grants write access — it alone can mint a LockedRun witness via RunLock::witness. Uninhabited: it exists only as a type tag.

Shared

Typestate marker: the shared (LOCK_SH) lock. A RunLock<Shared> is read-only and cannot produce a LockedRun witness, so it can never be used to reach a write-side entry point. Uninhabited: only a type tag.