[borovan]

MemoryManager reopening and refused growth currently force consumers to duplicate private layout validation and bucket accounting. This adds checked reopening, persisted-layout inspection and fallible growth at the manager owner.

try_init rejects nonempty foreign/corrupt/unsupported memory without resetting it, retaining existing geometry. The explicit bucket-size variant also rejects geometry mismatch. Checked reopening constructs the manager from the validated bucket lists instead of decoding the table twice. Existing load uses the same validator.

VirtualMemory::try_grow returns typed overflow, bucket exhaustion, backing refusal and reentrancy errors. Backing capacity is reserved before bucket assignment or virtual-size publication. Checked growth also rejects zero cached geometry from an existing unchecked constructor. The Memory::grow implementation uses that same assignment owner and returns -1 on refusal, replacing the prior backing-refusal panic after bucket mutation. Stable layout and collection contents are unchanged. Backing traps/partial writes retain the backing's own execution semantics.

Validation at upstream base b5d1650:
Qualified PR head: b1dd27b (zero-geometry follow-up included).

• Rust 1.99: all 327 active library tests pass (3 ignored); all 22 manager tests pass, including new corruption/no-write, refusal/retry/reopen and shared-handle reentrancy coverage.
• Rust 1.85: all-target check and the upstream CI-style clippy --tests --benches -- -D clippy::all pass.
• Rust 1.99 Wasm rustdoc builds with warnings denied; formatting and diff checks pass.

Remaining qualification: the upstream-selected Rust 1.84 compiler is not installed here; mdbook and its plugins are not prepared; no macOS-native, installed IC upgrade or IC instruction/size claim is made. Strict Rust 1.99 native rustdoc and Clippy encounter existing README conditional-link/ASCII-diagram lint errors outside this patch; original failed logs are retained. The root has no Cargo example targets, so its --examples check was a no-op rather than example qualification.

IC Memory will retain its current published-dependency guards until an accepted published API and exact consumer layout/corruption/growth/installed qualification permit removing them. No downstream dependency/version selection, release or stable-data reset accompanies this draft.