Merge pull request #229 from fiddlerwoaroof/fix/we1a-abort-refuses

Pin that every aborting model effect also refuses (improvise-we1a)

context/test-evidence/command.md

@@ -6208,3 +6208,57 @@ case fails. Second, the ticket's suggested fix, which drops the asker's
 reset and the client never heard. That rival also fails
 `a_geometry_command_relays_the_cursor_reset_to_the_asker_too` and the
 ws-server's `the_other_document_would_also_have_a_cursor_to_invalidate`.
+
+## `ui/host.rs` — the abort arm of `Host::mutating_frame` (improvise-we1a)
+
+### every_failing_model_effect_that_aborts_also_refuses
+
+What the gap was: `Host::mutating_frame` rejects a frame when
+`last_batch_refused() || last_batch_aborted()`. Every model effect that aborted
+also refused, so deleting the `|| last_batch_aborted()` arm left all tests
+passing. The wire table (`every_failing_model_command_refuses_its_whole_frame`)
+cannot hold the invariant, because that arm rejects a frame that aborted
+without refusing. The test applies each failing `ModelCommand`'s own effects,
+from `model_effects`, straight to an `App`, and asserts that the batch refused.
+Each case also carries whether it aborts. That catches a table in which nothing
+aborts, and a site that quietly stops aborting.
+
+Faults injected:
+- `AddCategory`'s failure arm set `status_msg` and aborted, but did not refuse.
+  - This test failed, and so did the key-path table.
+  - The wire table passed, which is the gap.
+  - With the arm also deleted, `a_refused_mutation_rolls_back_its_predecessor_and_the_abort_flag`
+    failed as well. So the arm is what makes the wire table look correct under
+    this fault.
+- `refuse_and_stop` wrote the status and aborted without refusing. This test
+  failed, as did the key-path table,
+  `a_failed_load_or_import_does_not_run_the_quit_after_it` and
+  `a_formula_that_does_not_parse_keeps_the_user_in_the_editor_with_their_text`.
+  The wire table passed.
+
+What this table cannot see (improvise-lasd, found in review of #229): a site it
+does not list. The fault injected was `on_view`'s missing-view branch changed to
+write the status and abort, without refusing. The workspace stayed green, and
+only `Host::mutating_frame`'s `|| aborted` arm caught it. That is why
+`App::apply_effects` now carries a `debug_assert!`: a `Model` effect that aborts
+must have refused. Under the same fault, the assertion fails two existing tests:
+- `a_frame_writing_a_view_its_own_first_command_deleted_is_refused`, with
+  `SetNumberFormat(Named("Scratch"), ",.2f")`;
+- `a_command_naming_a_view_the_document_has_not_got_writes_nothing`, with
+  `SetAxis { view: Named("NoSuchView"), .. }`.
+
+With the assertion removed, the same fault fails nothing.
+
+### every_refusal_site_refuses_its_failure_and_only_its_failure — three cases (improvise-rtud)
+
+This entry covers the rows `load of an absent file`, `import-json of an absent
+JSON` and `a formula that does not parse`. Each has a succeeding twin
+(`load doc.improv` from `MemoryFs`, `import-json good.json`, `Total = 1`).
+Each row was checked by a rival at its own site: the `refuse_and_stop` call in
+`AddFormula`'s parse arm, in `LoadModel`, or in the JSON read arm of
+`ImportJsonHeadless`, replaced by a status write plus the abort. Under each
+rival, the table fails at that row. The matching row of
+`every_failing_model_effect_that_aborts_also_refuses` fails too. A rival in
+`refuse_and_stop` itself is no use here, because the table stops at its first
+failing row, which is the older `import-json of an absent CSV`. The rtud prose correction is landing separately, so these
+rows are coverage only.