fix(#70): harden the tracked-span revert per branch review

- shiftTracked (pure, anchorer.ts + unit tests): interior/outside edits shift,
  boundary-straddling edits distrust; an insertion exactly at the span start
  lands BEFORE the span (never absorbed into the revert target)
- clear tracked spans on doc close (a closed buffer can change on disk with no
  change events — a kept span could revert over unrelated text, INV-11)
- renderAll only REBUILDS an absent span from an exact resolve; a present entry
  is continuously-tracked ground truth (duplicate-text resolve can't clobber it)
- revertInPlace/finalizeInPlace gain the guard.isReadOnly check (INV-16)
- the hard-fail warning offers 'Discard proposal (leave text)' so a reloaded
  session can still dismiss an unlocatable proposal record
- ✓/✗ CodeLens pair anchors at the tracked span when a tweak orphans the exact
  anchor (the fixed reject path stays reachable from the primary gesture)
- QuickPick batch menu routes through the reporting accept-all/reject-all
  commands (a discarded skip tally re-created the silent failure)
- one clearProposal helper replaces the thrice-copied clear sequence;
  reject() now cleans applied/appliedSpans too

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/anchorer.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect } from "vitest";
-import { buildFingerprint, resolve, shift, type OffsetRange } from "../src/anchorer";
+import { buildFingerprint, resolve, shift, shiftTracked, type OffsetRange } from "../src/anchorer";
 
 const DOC = "line0\nline1 needle here\nline2\nneedle again on line3\n";
 
@@ -67,3 +67,54 @@ describe("shift", () => {
     expect(shift(r, { start: 3, end: 7, newLength: 1 })).toEqual({ start: 3, end: 7 });
   });
 });
+
+describe("shiftTracked (#70 — tracked applied spans)", () => {
+  const r: OffsetRange = { start: 10, end: 20 };
+
+  it("edit entirely before the span shifts both endpoints by the delta", () => {
+    expect(shiftTracked(r, { start: 0, end: 0, newLength: 3 })).toEqual({ start: 13, end: 23 });
+  });
+
+  it("edit entirely after the span leaves it unchanged", () => {
+    expect(shiftTracked(r, { start: 25, end: 28, newLength: 0 })).toEqual({ start: 10, end: 20 });
+  });
+
+  it("edit fully inside the span keeps the start and grows/shrinks the end", () => {
+    // replace [12,15) with 5 chars (delta = +2)
+    expect(shiftTracked(r, { start: 12, end: 15, newLength: 5 })).toEqual({ start: 10, end: 22 });
+  });
+
+  it("replacing the span's exact full contents is an interior edit", () => {
+    expect(shiftTracked(r, { start: 10, end: 20, newLength: 4 })).toEqual({ start: 10, end: 14 });
+  });
+
+  it("an insertion exactly at the span start lands BEFORE the span (never absorbed)", () => {
+    expect(shiftTracked(r, { start: 10, end: 10, newLength: 6 })).toEqual({ start: 16, end: 26 });
+  });
+
+  it("an insertion exactly at the span end lands AFTER the span (never absorbed)", () => {
+    expect(shiftTracked(r, { start: 20, end: 20, newLength: 6 })).toEqual({ start: 10, end: 20 });
+  });
+
+  it("an insertion at an EMPTY span's point lands before it (deletion-proposal span)", () => {
+    const empty: OffsetRange = { start: 10, end: 10 };
+    expect(shiftTracked(empty, { start: 10, end: 10, newLength: 3 })).toEqual({ start: 13, end: 13 });
+  });
+
+  it("an edit straddling the span's start boundary is distrusted (INV-11)", () => {
+    expect(shiftTracked(r, { start: 8, end: 12, newLength: 0 })).toBe("distrusted");
+  });
+
+  it("an edit straddling the span's end boundary is distrusted (INV-11)", () => {
+    expect(shiftTracked(r, { start: 18, end: 22, newLength: 1 })).toBe("distrusted");
+  });
+
+  it("an edit fully containing the span (e.g. a wholesale replace) is distrusted (INV-11)", () => {
+    expect(shiftTracked(r, { start: 0, end: 30, newLength: 12 })).toBe("distrusted");
+  });
+
+  it("a deletion consuming an EMPTY span's neighborhood is distrusted (INV-11)", () => {
+    const empty: OffsetRange = { start: 10, end: 10 };
+    expect(shiftTracked(empty, { start: 8, end: 12, newLength: 0 })).toBe("distrusted");
+  });
+});

test/e2e/suite/f12InlineDiff.test.ts

@@ -320,6 +320,35 @@ suite("F12 inline diff — #70 reject after interior edit (INV-5)", () => {
     assert.strictEqual(doc.getText(), "# T\n\nOne aaa.\n\nTwo bbb.\n", "document fully restored (INV-5)");
     assert.strictEqual(p.listProposals(doc).length, 0, "all cleared");
   });
+
+  // The decision gestures must stay REACHABLE for a tweaked proposal: the ✓/✗
+  // CodeLens pair anchors at the tracked span when the interior tweak orphans
+  // the exact anchor — otherwise the fixed reject path exists only at the API.
+  test("the ✓ Keep / ✗ Reject CodeLens pair survives an interior tweak (tracked-span anchor)", async () => {
+    const ORIGINAL = "Lens target sentence here.";
+    const { doc } = await freshDoc("docs/s70-lens-tweak.md", `# T\n\n${ORIGINAL}\n`);
+    const api = await getApi();
+    const p = api.proposalController;
+    const fp = { text: ORIGINAL, before: "", after: "", lineHint: 2 };
+    const id = await p.propose(doc, fp, "Lens TARGET sentence here.",
+      { kind: "agent", id: "claude", agent: { sdk: "x", model: "m", sessionId: "s" } }, { granularity: "block" });
+    await p.optimisticApply(doc, id!);
+    await settle();
+    const at = doc.getText().indexOf("TARGET");
+    const we = new vscode.WorkspaceEdit();
+    we.replace(doc.uri, new vscode.Range(doc.positionAt(at), doc.positionAt(at + 6)), "TARGET-tweaked");
+    assert.ok(await vscode.workspace.applyEdit(we), "interior tweak applied");
+    await settle();
+    assert.strictEqual(p.listProposals(doc).find((v) => v.id === id)!.anchorStart, null, "anchor orphaned");
+    const lenses = api.editorProposalController.provideCodeLenses(doc);
+    const titles = lenses.map((l) => l.command?.title);
+    assert.deepStrictEqual(titles, ["✓ Keep", "✗ Reject"], "the pair survives the tweak");
+    assert.deepStrictEqual(lenses[1].command!.arguments, [id], "reject lens still targets the tweaked proposal");
+    // The reject it routes at still restores the original (the Task-1 contract).
+    assert.ok(await p.revertInPlace(p.keyFor(doc), id!), "reject via the surviving gesture succeeds");
+    await settle();
+    assert.strictEqual(doc.getText(), `# T\n\n${ORIGINAL}\n`, "original restored exactly (INV-5)");
+  });
 });
 
 // Reload-safety: a proposal that was optimistically applied in a PRIOR session