fix(web): a socket that never opened did not disconnect

The `close` listener wrote "disconnected" unconditionally, so a connection
that failed loudly -- the `error` listener having already written "cannot
reach <url> -- is improvise-ws-server running?" -- was immediately followed
by a close event replacing it with the vaguer of the two facts. The user saw
the least informative thing that happened.

This is the watchdog bug's family and deliberately NOT its fix. The watchdog
is for silence only, so it is disarmed; suppressing `close` outright would
hide a genuine mid-session disconnect, which is the one thing that listener
is really for. So the two cases are split rather than one being guarded.

A CORRECTION TO THE TICKET'S SUGGESTED MECHANISM: it proposed reading
`readyState` at close time, and that cannot work. `readyState` is already
CLOSED by the time a close listener runs, whichever happened, and the
CloseEvent cannot separate them either -- a refused connection and a
mid-session network drop are both code 1006 with `wasClean: false`. The only
discriminator is whether `open` ever fired, which the page must remember for
itself. Hence the `opened` flag.

Both arms go through `setShellFailure`, because a drop before the first frame
leaves the watchdog armed and "disconnected" is more precise than the guess
it would fire 8s later.

The header comment stating the `#status` vocabulary is updated in the same
commit: that fact is stated twice, and gotcha 48 says changing it is a grep.

VERIFICATION IS READING, and that is the whole budget. There is no browser
and no headless DOM here, so this is `node --check` (proved discriminating by
appending an unbalanced paren and watching it fail) plus confirmation that
every call app.js makes is in the generated .d.ts at the right arity:
on_frame/1, on_key_event/5, render_model/0, set_viewport/2, typed_cell/3.
Both wasm bundles still build. The listener itself has never been executed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

web/app.js

@@ -39,6 +39,9 @@
 // Neither is reachable silently. Every transport writes what it is doing to
 // `#status` — "starting", "connected", "cannot reach …", "disconnected" — so
 // a peer that never arrives reads differently from one that went away.
+// "disconnected" means exactly the second: a socket that opened and then
+// closed. A socket that never opened keeps saying "cannot reach …", because
+// the close event there is the tail of the failure and not news.
 
 import init, { Client } from "./pkg/improvise_wasm_client.js";
 
@@ -191,8 +194,17 @@ function workerTransport() {
 /** A websocket to `improvise-ws-server`: how a TUI-hosted document is shared. */
 function socketTransport() {
   const socket = new WebSocket(WS_URL);
+  const unreachable = `cannot reach ${WS_URL} — is improvise-ws-server running?`;
+  // Did this socket ever open? The page has to record that itself, because
+  // nothing on the close event carries it: `readyState` is already CLOSED by
+  // the time a close listener runs, whichever happened, and a refused
+  // connection and a mid-session network drop are BOTH code 1006 with
+  // `wasClean: false`. So "never connected" and "was connected and went away"
+  // are distinguishable only by remembering.
+  let opened = false;
   const ready = new Promise((resolve) => {
     socket.addEventListener("open", () => {
+      opened = true;
       setShellStatus(`connected · ${WS_URL}`);
       resolve();
     });
@@ -200,10 +212,23 @@ function socketTransport() {
   socket.addEventListener("message", (event) => onFrame(event.data));
   // Without this, a connection that never opens left #status blank and
   // "server not running" read exactly like "still connecting" (improvise-hwpi).
-  socket.addEventListener("error", () =>
-    setShellFailure(`cannot reach ${WS_URL} — is improvise-ws-server running?`),
+  socket.addEventListener("error", () => setShellFailure(unreachable));
+  // A socket that never opened did not "disconnect" — it failed to connect,
+  // and the close event is the tail of that failure rather than a second,
+  // vaguer thing that happened (improvise-taxx). Writing "disconnected" here
+  // unconditionally replaced the `error` listener's precise message with the
+  // least informative of the two facts.
+  //
+  // Same family as the watchdog bug and NOT the same fix: the watchdog is
+  // disarmed because it is for silence only, whereas suppressing `close`
+  // outright would hide a genuine mid-session disconnect, which is the one
+  // thing this listener is really for. Hence the split rather than a guard.
+  // Both arms go through `setShellFailure`: a drop before the first frame
+  // leaves the watchdog armed, and "disconnected" is more precise than the
+  // guess it would fire 8s later.
+  socket.addEventListener("close", () =>
+    setShellFailure(opened ? "disconnected" : unreachable),
   );
-  socket.addEventListener("close", () => setShellStatus("disconnected"));
   setShellStatus(`connecting to ${WS_URL}…`);
   return {
     send: (text) => {