Function append_and_apply_unlocked 

pub fn append_and_apply_unlocked(
    witness: &LockedRun<'_>,
    paths: &RunPaths,
    kind: &str,
    node_id: Option<&NodeId>,
    idempotency_key: Option<&str>,
    data: Value,
) -> Result<u64>

Append one event and fold it into projections. The _witness: &LockedRun is compile-time proof the caller already holds the run’s exclusive RunLock — obtained from RunLock::with_lock or RunLock::witness, so this entry point cannot be reached without the lock. The sanctioned lock-held composition path: use it to fold extra logic (an idempotency-key lookup, a status precondition) or several writes (the supervisor’s derived discussion/spinoff batch) into one locked critical section. Calling append_and_apply_event from within a held lock would deadlock because flock blocks when a second open of the lock file from the same process tries to acquire LOCK_EX.

The witness is mandatory

Without a &LockedRun proof the lock is held, this does not compile — there is no way to skip the parameter, and LockedRun cannot be constructed outside this crate (its field is private), so the only source is a held RunLock:

use taskfleet_core::{append_and_apply_unlocked, RunPaths};
// No witness passed — the first argument must be a `&LockedRun`, which a
// caller can only obtain by actually holding the run's exclusive lock.
let _ = append_and_apply_unlocked(paths, "run.status", None, None, serde_json::json!({}));