ElyMark: renders asked of a failed page end at once (M-08)

The tally remembers why the page went down; until a load succeeds,
render() ends each new request with that reason instead of calling a
dead page. end_renders is a free function with a gpui test.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tasks/BUGS.md

@@ -68,7 +68,7 @@
 - [x] M-05 点页面里的链接什么也不发生 — 页面拦下链接单击，地址取链接标记原文，预览单击、可视 Cmd/Ctrl 单击交应用（审查 4 轮）
 - [x] M-06 `on_app_quit` 无条件删恢复点与崩溃锁，AppKit 直接终止时丢未保存内容 — 未保存时退出只放下锁、不清点，窗口释放时不再删（审查 1 轮）
 - [x] M-07 崩溃恢复的未命名副本按“第一个显示的未命名标签”配对，内容可能落错标签 — 未命名副本按新建时记下的标签号配对，经 Keeping::take（审查 2 轮）
-- [ ] M-08 页面重载后悬着的渲染回调永不完成，导出既不成功也不报错
+- [x] M-08 页面重载后悬着的渲染回调永不完成，导出既不成功也不报错 — 页面失败后挂起与新到的渲染都以错误结束，载入成功才恢复（审查 2 轮）
 - [ ] M-09 导出的保存面板出错被当作取消
 - [ ] M-10 关闭查找框只清当前标签的高亮
 - [ ] M-11 页面把搜索词写进应用日志

tasks/reviews/M-08-r1.md

@@ -0,0 +1,5 @@
+FAIL
+
+apps/ely-mark/src/view.rs:212 — `render` queues requests after the page has failed; `heard` at line 270 only ends requests already pending. Native WSL CEF reproduction: deny read access to the disposable page's index.html and reload. Both existing renders correctly receive ERR_ACCESS_DENIED. Request another render while the fault is displayed: Chromium logs `ely is not defined`, and its callback never runs until a later successful reload ends it with `the page reloaded`. HTML, text and PDF exports therefore still hang without an output or export error when requested after failure. Retain the failure state and asynchronously reject new renders until a successful load clears it. Evidence: `/home/raidenmei/m08-native-probe.log`; rendering succeeds again after recovery.
+
+apps/ely-mark/src/tally.rs:102 — The render regression checks one value returned by `restart`, but never verifies callback execution through `Loaded`/`Failed`, `end_renders`, or the export error handlers. In a disposable source copy, replacing the entire `end_renders` body with a no-op leaves all 22 Linux tests passing while silently dropping every interrupted export. The native CEF probe detects that mutation: after failure, zero callbacks complete instead of two. Add regression tests that exercise both lifecycle events with multiple owed renders, assert each callback receives its error exactly once and reaches the export failure path, reject late replies, and cover requests made after failure. Evidence: `/home/raidenmei/m08-mutation-tests.log`, `/home/raidenmei/m08-native-mutation.log`. Baseline cargo tests: Linux 22/22; Windows 20/21, with only the documented W-02 trailing-space Git-path failure (20/20 when excluded). Probe copies, their target directories and both platforms' incremental caches were removed before this verdict; only small evidence logs remain.

tasks/reviews/M-08-r2.md

@@ -0,0 +1 @@
+PASS