C14.15 r1: failed recovery and session writes show in the window, once each, with the last kept time

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

tasks/reviews/C14.15-r1.md

@@ -0,0 +1,5 @@
+FAIL
+
+1. apps/ely-mark/src/restore.rs:322 — Recovery-write failures only reach the log. For an unsaved tab, make the recovery destination unwritable (the probe replaces `recovery/` with a regular file), then run `keep`: the write finishes unsuccessfully, `pointed` remains absent, and the window shows no error or last successful recovery time. A subsequent crash loses this text without warning. This violates PRD §6.2 and UX-06. Pass the failure back to the window, retain and expose the last successful recovery time, and add a window regression for failed recovery writes. WSL probe `a_failed_recovery_write_is_visible` fails with `TOASTS before=[], after=[]`; evidence: `.work/C14.15-r1/probe-test.log`.
+
+2. apps/ely-mark/src/restore.rs:334 — Session-write failures also only reach the log. If `session.json` cannot be replaced (the probe creates a directory at that path), `keep` returns without telling the user that the tabs, modes, caret and scroll were not persisted. A crash then leaves the previous session snapshot, or none, so the latest session cannot restore. This violates MARK-12 and UX-06. Surface the failed session write in the window while retaining the previous snapshot and retry behavior; add a window regression for this failure. WSL probe `a_failed_session_write_is_visible` fails with `TOASTS before=[], after=[]`; evidence: `.work/C14.15-r1/probe-test.log`. Baseline `cargo test -p ely-mark` passes on Windows (88 tests) and WSL Linux (89 tests); logs are in the same folder. Probe source copies, their target directory and both platforms' incremental caches were deleted before this verdict.