review: two corrections from the #92 adversarial review, and a P2 they found

1. THE JMJZ WIDTH ASSERTION COULD NOT SEE A WINDOWED WIDTH, and the evidence
said it could. Injecting `if drawn { widen(..) }` -- widths from the window only
-- left 1476 passing, 0 failing. Two reasons, the second structural: the measure
was named `Revenue` (7 chars) against a value of `300021` (6), so the assertion
passed on the header alone; and comparing grid_body's widths against
compute_col_widths is INCAPABLE of testing windowing, because compute_col_widths
IS grid_body with an empty window. Windowing degrades both sides identically.
The same function twice is not a check, and it reads exactly like one.

Fixture is now the reviewer's shape -- a total that cancels and a one-character
header -- reordered once more so BOTH assertions discriminate: with the large
values last, the windowed row and the cancelled total were both 1.0, so the
totals assertion went blind to the row-window fault while the widths assertion
happened to catch it. Large values first:

  for ri in rows.clone()        -> totals [888888888.0] against [1.0]
  if drawn { widen(..) }        -> widths [10] against [11]

10 rather than 5 is a smaller gap and a better witness: the missing character is
the minus sign of a row outside the window.

2. THE T6DB none_cats PARAGRAPH REPORTED A NEGATIVE RESULT FROM A SETUP THAT
LACKED THE CONDITION -- and correcting it found a P2. The fixture was said to put
Product on Axis::None in one view and on Column in another. It did not:
add_category defaults to Column and nothing moved it, so all three views had
none_cats {_Index, _Dim} and the stated input to the hazard was absent.

Setting it explicitly failed the property on the first run, and not on a cell
value: Second loses BOTH Total columns when the host stands on Default.
rebuild_layout fills Model::formula_cache for the HOST's view, and grid_in on the
elsewhere path builds another view's layout against that stale cache -- the Total
cells are keyed without a Product coordinate, the other view asks for one, finds
nothing, and prune_empty drops the columns. Filed improvise-ac2z (P2). Not local:
grid_in takes &App and recompute_formulas needs &mut Model.

Guarded by a_hosts_none_cats_leak_into_another_views_formula_columns, a
characterization test whose message says that failing means the bug is fixed. The
property skips pairs whose none_cats differ and asserts compared > 0, so a future
fixture cannot skip everything and pass.

3. Smaller, all taken. "Nothing else fails" on the t6db injection was wrong: it
fails three tests, including the pre-existing prune-invalidation one -- the #78
fix had more coverage than it was credited with. And the 5ubs should_panic named
one thing and exercised another: pointed at a struct it reached only the
split_once branch, and all three panics shared one literal so `expected` could not
discriminate. The parse is now a `parse_expected` seam fed hand-written mutated
messages, each refusal with its own wording, plus a happy path.

1470 -> 1475 passing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FC2jVn8Au7E9JPkw6bwXXH

context/test-evidence/protocol.md

@@ -489,15 +489,40 @@ compile with the probe, because `improvise-wasm-client/src/socket.rs` matches
 `Rejection` exhaustively — which is a *different* guard and does not catch the
 omission, since the omitted variant there is one it was forced to name.)
 
-### variants::tests::a_message_that_is_not_an_unknown_variant_is_refused
+### variants::tests::a_type_that_is_not_an_externally_tagged_enum_is_refused
 
-The checker's own checker. A parse of serde's message that silently fails would
+### variants::tests::a_message_with_no_expected_clause_is_refused
+
+### variants::tests::a_message_that_lists_something_other_than_variants_is_refused
+
+### variants::tests::a_list_that_collapses_to_one_name_is_refused
+
+### variants::tests::a_well_formed_message_yields_its_names
+
+The checker's own checker. A parse of serde's message that silently failed would
 return an empty name list, and an empty list is a subset of everything — every
-cycle would pass and the guard would be worse than absent. Pointing `declared`
-at `Basis`, a struct, produces a message with no `expected one of` clause; the
-helper must panic rather than return. Asserting the panic *message* and not
-merely that it panics, because a helper that panicked for some other reason
-would satisfy a bare `should_panic`.
+cycle would pass and the guard would be worse than absent.
+
+**The first version named one thing and exercised another**, found by the PR #92
+review. It pointed `declared` at `Basis`, a **struct**, so serde answers
+`invalid type … expected struct Basis` — which reaches only the
+`split_once → None` branch. The `starts_with("unknown variant")` and
+`names.len() > 1` refusals were exercised by nothing, and all three panics shared
+the literal `"serde no longer says"`, so `expected = …` could not discriminate
+which had fired. **A `should_panic` whose message matches several panics is a
+check that cannot say what it caught.**
+
+The parse is now `parse_expected(&str)`, a seam fed hand-written mutated
+messages, each refusal carrying its own wording:
+
+- no `expected one of` clause → `serde stopped listing the variants`
+- an `unknown field` list rather than a variant list → `serde stopped saying
+  \`unknown variant\``
+- a list that collapses to one name → `the variant list did not parse`
+
+plus a happy-path case, so the three refusals are not the only evidence the
+parser runs at all. `a_type_that_is_not_an_externally_tagged_enum_is_refused`
+keeps the end-to-end shape through a real `Deserialize`.
 
 
 ### render::tests::a_frame_that_lost_its_origin_does_not_claim_to_lead_the_axis