Fix memory errors, transactional locking and recovery

[reacherwu]

Scope

First priority reliability checkpoint only: propagate storage failures to CLI nonzero exit / MCP isError; OS advisory sidecar lock across read-modify-write; validated atomic persistence and explicit check/backup/restore; JSON memory responses; non-destructive init, option parsing and UTF-16 surrogate compatibility. Requires Rust 1.89+.

Evidence

P1_REGRESSION.md and P1_REGRESSION.log record six selected CLI regressions and thirteen storage tests (all passed). Release build passed locally. Independent initial review found three P1s; fixes and targeted regressions are committed. Final independent re-review remains pending; this is a DRAFT, not a production certification.

Explicit limitations and remaining work

• Stop ALL legacy writers before changing lock protocol. Do not delete permanent lock sidecars while new writers run. Local cooperating processes only; consistent paths required, no hard-link aliases / network-filesystem guarantees.
• CTNM0001 remains compatible and has NO checksum: check/restore validate structure, not cryptographic integrity. Directory sync errors after rename may leave a published state; do not blindly retry mutations.
• Native MCP frame/depth/output budgets, broad Unicode/recall quality benchmark, checksum format migration, and public marketing-claim cleanup remain follow-up work.
• The runner false-causality changes/tests are deliberately NOT part of this commit; they remain local pending separate review. Existing runner auto-learning behavior in this PR is not corrected yet.
• Broad lint-only changes were reverted to avoid scope expansion; upstream lint warnings remain.
• Existing install and live Hermes memory were not changed. No automatic hook installation or production deployment.

Do not merge until final review and remaining acceptance gates are resolved.

[reacherwu]

🐕 DiffHound AI PR Guard: ⚠️ Regression Warning

Attention: DiffHound detected changes touching sensitive historical bug fixes.

File & Location	Causal Score	Historical Commit & Provenance	Remediation Guidance
ARCHITECTURE_PLAN.md:1	0.6620	RULE: Anti-bloat & Minimalist Modular Design: Pursue deep modules with narrow interfaces and rich implementation; avoid shallow wrapper layers (classitis); adhere to YAGNI and Data Dominates	Added code in 'ARCHITECTURE_PLAN.md' matches historical failure pattern. Check historical commit provenance before merging to prevent recurring outages.

💡 Why this matters: AI coding assistants (Cursor, Claude) frequently delete legacy fallbacks or timing pragmas during refactoring. Verify these constraints before merging.

_{⚡ Powered by DiffHound Zero-Noise Anti-Regression Engine}