AppliedKeys

A Transactional target's applied-keys table, fenced by the claim token of the run acting on it (design §4.24). The target keeps, for each key scope (one per thread), the newest FencingToken any operation on that scope has carried, and every operation on the scope - the effect given to ReplayGuard.transactional and forget - does this in one transaction:

• a token older than the scope's newest is refused with a Left, changing nothing: a run that lost its claim can neither apply, nor read back, nor forget anything after its successor touched the target, whatever it saw in the thread's store before it was taken over;
• otherwise the scope's newest token becomes this one, and the operation goes ahead. The effect records (key, outcome) with the effect, or, for a key already applied, returns the recorded outcome and writes nothing.

The newest token per scope is kept for as long as the target keeps data of that thread: a small record per thread, as the thread store's tombstones are. ReplayGuard.transactional trusts an applied key only while the thread's store holds the effect's begun record, and forgets it once the outcome is recorded there.