Undo-block review fixes: exception-safe depth, corrected docs, real test teeth

Fixes ctor exception safety, a ValidatePtr2 guard, false SDK-citation and
enforcement claims, the span-depth invariant, and vacuous fx_reclaim tests.

src/shell/view/CLAUDE.md

@@ -159,6 +159,15 @@ decide membership or mode rules.
   The mirror half is still `applyMode`'s: a REAPPLY never closes a span, precisely
   because it is reachable from inside one of those blocks — only a real switch
   supersedes, and a real switch is always fired at depth 0.
+  **Consequently, a span is never open at depth > 0.** The only two openers are a real
+  switch (always fired straight from an action handler, never from inside another
+  block) and the reclaimer's own lazy `writeOffline`, which the residual above makes
+  unreachable at depth > 0. This is what lets `fxReclaimAbandonForStateLoad` and
+  `fxReclaimFlushRelease` close the span unconditionally with no depth check of their
+  own, even when the hook that calls them fires from inside an extension `UndoBlock` —
+  a capture's own save can (`capture_orchestrator`'s `RunCaptureItemAssign` wraps
+  `RunCapture`, which reaches `Main_SaveProject`). `closeSpan()` there just finds
+  nothing open.
   ACCEPTED, and not fixed: `mintManagedLanes` opens its block once its plan is
   non-empty, but a non-empty plan whose writes are all already satisfied still mints
   nothing — so a background detect tick can end a switch's span having competed with it