I'm assuming ‘complete unless open’ applies to file open before the device is locked, and that if I need to open files while the device is locked, I need to use 'none.' It's also unclear if I need to set the protection on the parent directory. Does that ever matter?

RTFM: Don't update existing items, make new items and sections and call CPListTemplate.updateSections.