rules API: protect against concurrent updates