Plan

A Verifiable effect about to run: the target's digest before and after it, the outcome it reports when it lands (presumed, returned by a replay that finds it landed), and the effect.

The effect must be a compare-and-set against before: atomically at the target - under a lock every writer of the target takes, an OS file lock across processes - it checks that the digest is still before, and only then writes; otherwise it writes nothing and returns GraphError.EffectReplayRefused. That is what fences a run that lost its claim with its effect already under way: whichever of it and its successor writes second finds the digest moved and changes nothing. A target that cannot compare and set atomically is not Verifiable.