fix(proposals): reload-safe optimisticApply + reconciled toolbar summary (#64)

Final-review fixes:
- CRITICAL: optimisticApply no longer re-captures `original` from an
  already-applied buffer after a window reload (in-memory `applied` set is
  empty post-reload). A proposal already carrying `original` is marked applied
  and skipped, so Reject's revert target survives save+reload (INV-51/54).
  Adds a reload-safety host-E2E that reproduces the prior-session state.
- MINOR: the preview toolbar +N/-N summary now counts against the landed text
  (current minus pending proposals) via the new pure landedTextOf(), so a
  pending change is shown once (as a proposal), not double-counted (INV-50).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

test/e2e/suite/f12InlineDiff.test.ts

@@ -3,6 +3,8 @@ import * as fs from "fs";
 import * as path from "path";
 import * as vscode from "vscode";
 import type { CowritingApi } from "../../../src/extension";
+import { addProposal, setProposalApplied } from "../../../src/proposalModel";
+import { buildFingerprint } from "../../../src/anchorer";
 
 const WS = process.env.E2E_WORKSPACE!;
 const settle = () => new Promise((r) => setTimeout(r, 400));
@@ -197,3 +199,53 @@ suite("F12 inline diff — control parity (#64, INV-53)", () => {
     assert.ok(entry && /editorLangId == markdown/.test(entry.when ?? ""), "palette-guarded on markdown");
   });
 });
+
+// Reload-safety: a proposal that was optimistically applied in a PRIOR session
+// persists with `original` set and its fp re-anchored to the applied text. A fresh
+// controller (empty in-memory `applied` set) must NOT re-capture `original` from the
+// already-applied buffer — doing so would clobber the true revert target and break
+// Reject. (Regression for the final-review CRITICAL; INV-51/54.)
+suite("F12 inline diff — reload-safety (#64, INV-51/54)", () => {
+  test("optimisticApply does not clobber a previously-persisted original", async () => {
+    const TRUE_ORIGINAL = "The original sentence here.";
+    const APPLIED = "The APPLIED sentence here.";
+    const { doc } = await freshDoc("docs/f12-reload.md", `# R\n\n${TRUE_ORIGINAL}\n`);
+    const api = await getApi();
+    const p = api.proposalController;
+    const key = p.keyFor(doc);
+
+    // 1) The buffer holds the APPLIED text (as the saved-while-pending file would).
+    const at = doc.getText().indexOf(TRUE_ORIGINAL);
+    const we = new vscode.WorkspaceEdit();
+    we.replace(doc.uri, new vscode.Range(doc.positionAt(at), doc.positionAt(at + TRUE_ORIGINAL.length)), APPLIED);
+    assert.ok(await vscode.workspace.applyEdit(we), "apply the prior-session applied text");
+    await settle();
+
+    // 2) Record the proposal directly in the sidecar exactly as a prior session left
+    //    it: fp anchored to the APPLIED text + `original` = the TRUE original. We do
+    //    NOT call optimisticApply, so this controller's in-memory `applied` stays empty.
+    const appliedAt = doc.getText().indexOf(APPLIED);
+    const appliedFp = buildFingerprint(doc.getText(), { start: appliedAt, end: appliedAt + APPLIED.length });
+    let id = "";
+    api.sidecarRouter.update(key, (a) => {
+      id = addProposal(a, appliedFp, APPLIED, { kind: "agent", id: "claude", agent: { sdk: "x", model: "m", sessionId: "s" } }, { granularity: "block" }).proposalId;
+      setProposalApplied(a, id, appliedFp, TRUE_ORIGINAL);
+    });
+    p.renderAll(doc);
+    await settle();
+
+    // 3) Re-entry as a reload would trigger (EditorProposalController re-applies on
+    //    onDidChangeProposals because `applied` is empty). The guard must preserve original.
+    await p.optimisticApply(doc, id);
+    await settle();
+    const view = p.listProposals(doc).find((v) => v.id === id);
+    assert.ok(view, "proposal still present");
+    assert.strictEqual(view!.original, TRUE_ORIGINAL, "true original preserved, NOT clobbered with the applied text");
+
+    // 4) Reject restores the TRUE original (not the applied text).
+    assert.ok(await p.revertInPlace(key, id), "revert");
+    await settle();
+    assert.ok(doc.getText().includes(TRUE_ORIGINAL), "reject restored the true original");
+    assert.ok(!doc.getText().includes(APPLIED), "applied text removed on reject");
+  });
+});