Add guarded memory transactions

[eric-levinson]

Summary

• add bounded guarded memory transactions with complete preflight, ordered apply/readback, reverse rollback verification, and permanent session lockdown after unverifiable rollback
• expose the transaction through the host protocol, SDK, and developer CLI with strict hostile-input and sanitized-output validation
• eliminate in-process scan self-matches by moving pattern, mask, staging, and retained context bytes into pagefile-backed MEM_MAPPED storage
• add opt-in, capability-gated allocation topology for read-only candidate lifecycle classification while preserving the exact legacy scan response
• prepare the reviewed 0.2.0-dev.2 developer preview and complete its live reversible-write gate

Root cause and impact

The original live gate could not prove a write because repeated in-process scans left scanner-owned binary copies in readable private memory. Later scan pages found those copies and returned TOO_MANY_MATCHES. Exact save records could also be absent until the relevant Dynasty table lifecycle loaded.

The recovery keeps every scanner-owned binary buffer outside the private-only search domain and adds bounded allocation metadata for read-only lifecycle classification. After a Hub → Recruiting → Hub transition, one masked LeagueSetting candidate was uniquely classified and reconstructed to the exact independently parsed 256-byte record.

Live safety evidence

• supported offline build and write eligibility verified
• exactly one authoritative permission candidate classified; no address or raw bytes persisted
• apply transaction: one operation, one byte, applied and verified
• full alternate COMMISHONLY record matched the independently derived image
• restore transaction: one operation, one byte, applied and verified
• full original ANY record matched after restoration
• no retry, other record write, save-file write, weekly advance, or session lockdown
• host ticks advanced and the game remained responsive
• candidate uninstalled after both applications closed; both original proxies restored and SHA-256 verified

Validation

• strict RED/GREEN TDD for transaction behavior, scan-storage isolation, allocation metadata, SDK/CLI validation, startup source policy, and CI release gates
• per-task independent specification and quality reviews
• whole-branch review plus fix-wave re-review: no remaining findings
• npm run check
• Node test suite: 87/87 passing
• clean Windows x64 Release build
• startup, memory-reader, telemetry, memory-transaction, and protocol smokes passing
• package allowlist and internal checksum verification passing
• preview ZIP SHA-256: 8BAC318E38F25239B919D492911B0DC995FB138BBB7F64EEEAA04F7905C2100F

Release boundary

This draft does not publish or tag v0.2.0-dev.2. After review and merge, the release checklist requires tagging the exact merged commit, publishing immutable ZIP/checksum assets as a GitHub prerelease, downloading them afresh, and independently verifying SHA-256 before Brooks integration begins.