Close the collapse's two dropped guarantees: latch applyMode against re-entrancy, pin its project once; correct three overclaiming doc lines

src/shell/view/view.h

@@ -40,15 +40,22 @@ inline bool applyMintsUndoPoint(bool realSwitch, bool wroteAnything) {
     return realSwitch || wroteAnything;
 }
 
+// True while an applyMode call is on the stack. applyMode fails closed when re-entered
+// (its FX writes are assumed to pump the message loop, so a timer tick or an action can
+// land inside one), and this lets a caller with no fallback test BEFORE it spends a
+// one-shot signal on a call that would be refused — see main.cpp's load glue.
+bool modeApplyInProgress();
+
 // Snapshots each about-to-park track's flags into `model`, caches/clears the
 // outgoing mode's solo state and replays the incoming mode's, runs planToggle,
 // applies park/restore writes — flags AND per-FX offline, synchronously — plus
 // parent visibility flags, then sets the active mode. ONE switch is ONE undo
 // point; everything it moved rolls back in a single Ctrl-Z. Returns false (no
-// mutation) if `targetModeId` isn't registered, or if this is a real switch
-// (target != active) while the transport is running. A reapply (target ==
+// mutation) if `targetModeId` isn't registered, if this is a real switch
+// (target != active) while the transport is running, if it is re-entered
+// (modeApplyInProgress), or if the project does not validate. A reapply (target ==
 // active) is never gated and never touches solo. `proj` == nullptr means the
-// current project.
+// current project, resolved ONCE and used for every call this apply makes.
 bool applyMode(ViewModeModel& model, const std::string& targetModeId, ReaProject* proj);
 
 // Splits any track visible in more than one mode while carrying its own media