per-app lock