brokerd, memoryd, gatewayd: a lock file keeps each to one instance

Co-Authored-By: ornith-1.5-35b-a3b <agent@wntrmute.dev>

crates/gatewayd/src/main.rs

@@ -7,7 +7,7 @@ use std::process::ExitCode;
 use std::sync::Arc;
 use std::sync::atomic::AtomicBool;
 
-use bxcore::secrets;
+use bxcore::{instance, secrets};
 use gatewayd::config::{Config, MATTERMOST_TOKEN};
 use gatewayd::serve::{START_FAILED, Tuning, run};
 
@@ -34,6 +34,8 @@ fn serve(path: &Path) -> ExitCode {
     //    `let loaded = match secrets::load("gatewayd", MATTERMOST_TOKEN, &source, &env)`: an Err(e)
     //    prints "gatewayd: {e}" (the error carries its own pointer).
     //    Then `if let Some(warning) = &loaded.warning { eprintln!("{warning}"); }`.
+    // 3b. The instance lock, `<home>/run/gatewayd.lock` (M5b spec, section 9a): after the secret,
+    //    which is read before anything is made, and before the directory and the socket.
     // 4. The state file's directory:
     //    `let dir = config.state_path().parent().map(Path::to_path_buf).unwrap_or_default();`
     //    `std::fs::DirBuilder::new().recursive(true).mode(0o700).create(&dir)`: an Err(e) prints
@@ -66,6 +68,14 @@ fn serve(path: &Path) -> ExitCode {
     if let Some(warning) = &loaded.warning {
         eprintln!("{warning}");
     }
+    let lock_path = config.paths.home.join("run/gatewayd.lock");
+    let _instance = match instance::lock(&lock_path) {
+        Ok(held) => held,
+        Err(e) => {
+            eprintln!("{}", e.line("gatewayd", &lock_path));
+            return ExitCode::from(1);
+        }
+    };
     let dir = config
         .state_path()
         .parent()