Review (three independent passes over the protected-write, shared-GUID, harness
and save-cost changes):
- Notebook::save_unlocked compared the file with a snapshot it had just read, so
  a section written since unlock was silently overwritten with the stale model.
  unlock now returns Unlocked { pages, snapshot } and the save commits against
  that snapshot.
- An acknowledged publication becomes the base that polls trust without
  validating; it is now validated before it is published.
- Global id table imports could grow the pending entry list without bound
  before the duplicate check at the table end; bounded per entry node. The
  GUID uniqueness check reuses the list.
- A corrupt cache patch length aborted on allocation; bounded by the patch.
  The recovery summary reads the working length from the patch header and the
  asset scan holds one image at a time.
- Sealed buffers are sized once so growth leaves no plaintext behind; a failing
  random source is no longer reported as malformed data; file-data strings are
  decoded checked; protected writing admits exactly one section key and refuses
  a writer that created a space. The save's working buffers are ordinary
  memory, and the owner doc now says so.
- cache_probe accepts a coalesced insert intent.

Growth: a rewritten object group stored the whole global id table of the
revision its objects were read from. It now stores the entries they name, and
no-op detection compares those entries. OneNote 2010 cold-reads the sparse
tables and leaves the file as written (corpus/table-growth).

Assisted-by: claude-fable-5.1, claude-opus-5