Prove every ext-state write by reading the key back, so no guard is constant-true

SetProjExtState's return describes the whole extname. The persist and the instrument's publish now re-read their key; both refusals can finally fire.

src/shell/persist/session.h

@@ -108,8 +108,16 @@ public:
     void bumpBankGeneration() { ++bankGeneration_; }
 
     // Serializes book/view/tail to ext state, clears the retired legacy
-    // `bank_index` key. No-ops with no active/saved project. Returns true iff
-    // a persist happened, so a caller can skip an undo block when nothing was written.
+    // `bank_index` key. No-ops with no active/saved project.
+    //
+    // Returns true iff the `banks` key READ BACK as exactly what this call wrote —
+    // the only per-key observation available under a shared extname
+    // (wire::extStateWriteLanded owns why SetProjExtState's own return cannot
+    // answer it). A false therefore covers four things without distinguishing
+    // them: no active project, an unsaved project, a rejected write, and a
+    // read-back that could not complete. The sibling keys (view/tail/ledger/
+    // version/generation) are written but NOT verified, so no caller may read
+    // this as "everything persisted" — only as "the bank state is in the project".
     bool saveToActiveProject();
 
     // Report-only prune dry-run: feeds the pure core with (present, referenced,