Test and fix error propagation through a whole message roundtrip

A very long intended feature but not previously tested or fully
implemented. The idea is: it is encouraged not to check for
errors at every step in message sending or even a message
roundtrip, but only where convenient. Actual processing stops
after the first error; subsequent processing steps will only
pass on the error code without causing more problems.

Incidentally, this is similar to error propagation with Rust's
Result type. But we don't have a Result type, we have types that
can be invalid and that can carry an Error as a property.

Most of the fixes are in I/O related paths.