document locking rules for spy API functions