Keep expire-save failures live; lossless snapshot, WHERE, ACL who

[chouswei]

Patch-level honesty cut on 0.19.18 (no version bump, tag, or PyPI publish). Follow-on from the doc-gate readiness probe in #201 (squash-merged as 8a634d3). This branch is rebased onto that master. SysML first: MN-REQ-01.9, MN-REQ-01.3, MN-REQ-01.10, MN-REQ-03.4, MN-REQ-05.3, then engine. Do not merge.

Owner decision — expire-save failure keeps RAM

When save-on-expire cannot write a snapshot (snapshot_unsaveable or any other save failure, such as an unwritable disk or directory), MemNet does not drop the session. It stays live in RAM, still counts against MEMNET_MAX_SESSIONS, and every sweep or access that retries expiry emits @WRN: expire_snapshot_failed|{code}. Access after TTL is @ERR: session_expired|overdue so the caller can fix and save, or close. An explicit session save that succeeds, or an explicit session close, ends that hold. session expire-status, session list, and the admin usage report expose the hold count (@STAT: expire_snapshot_failed|n| / sessions.expire_snapshot_failed). When save-on-expire is off, TTL still drops RAM.

Tests (in-process and live serve loopback): unsaveable expiry keeps and warns; later fix plus save clears; close clears; the held session still counts against the cap.

Endleaf compatibility — WHERE true

Endleaf's gate deletes edges with MATCH (n WHERE true)-[r {id:'…'}]->() DELETE r and never sends any other WHERE. Trivial WHERE true is honoured (not unsupported_predicate). In-process test_where_true_edge_delete_still_works and live test_endleaf_where_true_edge_delete use that exact spelling.

Bug 1 — snapshot save/load round-trip

Anything the write path accepts now saves and reloads byte for byte, including LF, CR, tab, VT, FF, FS/GS/RS, NEL, LS, PS, backslash, both quote kinds, $, braces, |, and CJK.

• Snapshot emit escapes every Python str.splitlines() separator plus | and \\; load splits records on LF only (not str.splitlines()).
• Undeclared RAM properties (GraphElement extras; Path-B locators such as qname) persist by widening the snapshot SCHEMA. Live session SCHEMA is unchanged. Extras on fixed tags EDG/LAW, or a widened SCHEMA over max_fields, refuse snapshot_unsaveable and write no file.
• One hard value cap across leftover pipe mutate, GQL mutate, and snapshot load: decoded raw UTF-8 of the property value. Knob MEMNET_MAX_VALUE_BYTES (default 4096; a product MAY raise it to 16384).
• GQL mutate refuses over-cap with @ERR: limit_exceeded|value_bytes {n}/{max}.
• line_bytes is the UTF-8 length of the escaped/raw leftover-pipe or snapshot line. Save verify and load share this check.
• Save fails closed: @ERR: snapshot_unsaveable|{tag} nick={nick} … and no file.

Bug 2 — MATCH WHERE SET/DELETE

WHERE is honoured or the whole statement is refused. Nothing is applied on refuse. MATCH ()-[r {id}]-() DELETE r honours relationship DELETE. MATCH (n WHERE true)-[r {id}]->() DELETE r remains the gated edge-delete spelling.

Bug 3 — ACL on save / load / close

When session ACL is enabled, session save, session load (into that ACL'd session), and session close accept --caller / MEMNET_CALLER and enforce acl_who / acl_denied / acl_forbidden. MCP passes caller. Without ACL, behaviour is unchanged.

#201 probe / docs flipped (not skipped)

tests/test_doc_gate_readiness.py, tests/doc_gate_lib.py, scripts/probe_doc_gate_readiness.py, and docs/operations/one-session-per-document.md now expect the fixed behaviour: multiline/CR round-trip, 16 KiB refused at mutate (value_bytes 16384/4096), WHERE honoured, ACL who on save/close, extras persist or refuse at save over max_fields. Expire-save failure keep-live is also taught there and in docs/cap-contract.md.

Synthetic data only. No real mn_… session ids in the tree.