0.22.1: Termux-compatible filesystem transactions

[llblab]

Summary

This hotfix removes the hard-link transaction primitive that prevented pi-telegram 0.22.0 from starting on Android/Termux filesystems.

It replaces that primitive with atomically published non-empty guard directories, generation-bound owner metadata, exact stale recovery, and fail-soft diagnostics without weakening exactly-one cross-process ownership.

Why

Issue #131 reports EACCES from linkSync immediately after upgrading from 0.21.1 to 0.22.0. A direct file-rename fallback would overwrite an existing guard and permit split-brain transaction ownership, so this release uses generation-specific directory guards and exact recovery fencing instead.

User-visible behavior

• Starts without requiring hard-link support from the filesystem.
• Preserves config, lock, thread-state, and JSONL serialization across processes.
• Contains diagnostics persistence failures instead of terminating Pi through an unhandled rejection.

Changed areas

• lib/locks.ts: staged directory publication, generation-specific owner paths, recoverable claimant markers, exact rollback/release, and legacy 0.22.0 file-guard migration.
• lib/logs.ts: synchronous and queued diagnostics failure containment.
• Tests/docs/package metadata: deterministic interleaving regressions, strict rejection child probe, transaction protocol documentation, and version 0.22.1.

Risk Notes

• Shared filesystem transaction and stale-recovery behavior changed; exact race barriers, injected filesystem failures, legacy migration, and replacement-owner fencing cover the high-risk paths.
• Live Termux confirmation remains post-release reporter evidence; the local release gate proves removal of linkSync and cross-process correctness on the available platform.

Validation

• npm run validate — 1,243 passed, 1 platform-only skip; typecheck passed; audit found 0 vulnerabilities; package dry-run produced @llblab/pi-telegram@0.22.1.
• Strict Domain DAG — 0 errors, 0 warnings.
• ABCd context validator — 0 errors, 0 warnings.
• Stale-recovery child-process barrier — 20/20 repeated runs passed.
• Independent final review — READY, no blocking findings.
• git diff --check — passed.