# fix: review findings in protected saves, the cache and the parser; store only named table entries · clo/snowbound

[View on GitCafe](https://git.cafe/clo/snowbound/commit/b26c81f7c036b864e287820c6d3b0498b64159cf)

Repository: [clo/snowbound](https://git.cafe/clo/snowbound)

Visibility: public

Requested revision: b26c81f7c036b864e287820c6d3b0498b64159cf

Requested commit: b26c81f7c036b864e287820c6d3b0498b64159cf

Commit: b26c81f7c036b864e287820c6d3b0498b64159cf

Tree: 9099c8bf67d44eb6888cb8981e5153fe4d07756a

Author: clover caruso

Committer: clover caruso

## Message

```
fix: review findings in protected saves, the cache and the parser; store only named table entries

Review (three independent passes over the protected-write, shared-GUID, harness
and save-cost changes):
- Notebook::save_unlocked compared the file with a snapshot it had just read, so
  a section written since unlock was silently overwritten with the stale model.
  unlock now returns Unlocked { pages, snapshot } and the save commits against
  that snapshot.
- An acknowledged publication becomes the base that polls trust without
  validating; it is now validated before it is published.
- Global id table imports could grow the pending entry list without bound
  before the duplicate check at the table end; bounded per entry node. The
  GUID uniqueness check reuses the list.
- A corrupt cache patch length aborted on allocation; bounded by the patch.
  The recovery summary reads the working length from the patch header and the
  asset scan holds one image at a time.
- Sealed buffers are sized once so growth leaves no plaintext behind; a failing
  random source is no longer reported as malformed data; file-data strings are
  decoded checked; protected writing admits exactly one section key and refuses
  a writer that created a space. The save's working buffers are ordinary
  memory, and the owner doc now says so.
- cache_probe accepts a coalesced insert intent.

Growth: a rewritten object group stored the whole global id table of the
revision its objects were read from. It now stores the entries they name, and
no-op detection compares those entries. OneNote 2010 cold-reads the sparse
tables and leaves the file as written (corpus/table-growth).

Assisted-by: claude-fable-5.1, claude-opus-5

```

## Parents

- [be6b82da9a9e19b3a47c24655949fd2d66db0800](https://git.cafe/clo/snowbound/commit/be6b82da9a9e19b3a47c24655949fd2d66db0800?format=markdown)

[Source at this commit](https://git.cafe/clo/snowbound/tree/b26c81f7c036b864e287820c6d3b0498b64159cf?format=markdown)