[bitplane]

Workspace refusals and cancellation could lose PPMd free blocks, publish only part of a split, or orphan a simulated header/array during model updates. Reserve all destination capacity before changing ownership, and retain the original free lists until glue's scratch work and final cancellation check succeed.

The patch shares the run-splitting logic, reserves old-array release slots across glue and splitting, and constructs new contexts from an inline state. Successful allocation order remains unchanged. A completed glue pass can remain committed if a later reservation fails; whole-symbol decoding still ends on error. Reservation-first ordering can report workspace exhaustion earlier under a tight limit.

Validation:

• Five new refusal/cancellation tests reproduced failures before the fix.
• 83 PPMd tests pass in debug, including every-admission failure sweeps, real workspace limits, late cancellation, and reference allocation ordering.
• 2,626 tests pass in the full release suite; 17 existing tests are ignored.
• 366 minimal-feature library tests pass; workspace Clippy and formatting pass.
• Three deterministic 2 MiB corpora produce byte-identical encoded output against the pre-change library and decode exactly.
• Independent claude -p plan and implementation reviews; review refinements checked again with no defects found.