fix(proposals): reload-safe optimisticApply + reconciled toolbar summary (#64)

Final-review fixes:
- CRITICAL: optimisticApply no longer re-captures `original` from an
  already-applied buffer after a window reload (in-memory `applied` set is
  empty post-reload). A proposal already carrying `original` is marked applied
  and skipped, so Reject's revert target survives save+reload (INV-51/54).
  Adds a reload-safety host-E2E that reproduces the prior-session state.
- MINOR: the preview toolbar +N/-N summary now counts against the landed text
  (current minus pending proposals) via the new pure landedTextOf(), so a
  pending change is shown once (as a proposal), not double-counted (INV-50).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

media/preview.css

@@ -89,6 +89,11 @@ pre.mermaid[data-cw-error] { color: var(--vscode-errorForeground); }
 }
 .cw-accept:hover { background: var(--vscode-testing-iconPassed, #2ea043); color: #fff; }
 .cw-reject:hover { background: var(--vscode-errorForeground, #f14c4c); color: #fff; }
+.cw-btngroup { display: inline-flex; }
+.cw-btngroup .cw-caret { border-left: none; padding: 0.1em 0.25em; }
+.cw-actions .cw-accept { font-weight: 600; }
+.cw-accept:hover, .cw-btngroup:has(.cw-accept) .cw-caret:hover { background: var(--vscode-testing-iconPassed, #2ea043); color: #fff; }
+.cw-reject:hover, .cw-btngroup:has(.cw-reject) .cw-caret:hover { background: var(--vscode-errorForeground, #f14c4c); color: #fff; }
 
 /* F7.1 (#22) intra-diagram mermaid diff legend. */
 .cw-mermaid-legend { display: flex; gap: 0.6rem; font-size: 0.75em; opacity: 0.85; margin: 0.2rem 0 0.6rem; }

media/preview.ts

@@ -94,13 +94,14 @@ acceptAllEl?.addEventListener("click", () => {
   vscodeApi.postMessage({ type: "acceptAll" });
 });
 
-// F10: delegated ✓/✗ accept/reject of pending proposals (routed back to the F4 seam).
+// F12/#64: Accept/Reject (+ caret → accept-all/reject-all) on a proposal block.
 body.addEventListener("click", (e) => {
   const btn = (e.target as HTMLElement)?.closest<HTMLElement>(".cw-actions button");
   if (!btn) return;
-  const block = btn.closest<HTMLElement>(".cw-proposal");
-  const id = block?.dataset.proposalId;
+  const id = btn.closest<HTMLElement>(".cw-proposal")?.dataset.proposalId;
   const action = btn.dataset.action;
+  if (action === "acceptAll") return void vscodeApi.postMessage({ type: "acceptAll" });
+  if (action === "rejectAll") return void vscodeApi.postMessage({ type: "rejectAll" });
   if (id && (action === "accept" || action === "reject")) {
     vscodeApi.postMessage({ type: action, proposalId: id });
   }

package.json

@@ -113,6 +113,21 @@
         "command": "cowriting.acceptAllProposals",
         "title": "Accept All Claude Proposals",
         "category": "Cowriting"
+      },
+      {
+        "command": "cowriting.rejectAllProposals",
+        "title": "Reject All Claude Proposals",
+        "category": "Cowriting"
+      },
+      {
+        "command": "cowriting.proposalAcceptMenu",
+        "title": "Accept Claude Proposal",
+        "category": "Cowriting"
+      },
+      {
+        "command": "cowriting.proposalRejectMenu",
+        "title": "Reject Claude Proposal",
+        "category": "Cowriting"
       }
     ],
     "menus": {
@@ -160,6 +175,18 @@
         {
           "command": "cowriting.acceptAllProposals",
           "when": "editorLangId == markdown"
+        },
+        {
+          "command": "cowriting.rejectAllProposals",
+          "when": "editorLangId == markdown"
+        },
+        {
+          "command": "cowriting.proposalAcceptMenu",
+          "when": "false"
+        },
+        {
+          "command": "cowriting.proposalRejectMenu",
+          "when": "false"
         }
       ],
       "editor/title": [

src/attributionController.ts

@@ -249,7 +249,7 @@ export class AttributionController implements vscode.Disposable {
     range: vscode.Range,
     newText: string,
     provenance: Provenance,
-    opts?: { expectedVersion?: number; turnId?: string },
+    opts?: { expectedVersion?: number; turnId?: string; landBaseline?: boolean },
   ): Promise<boolean> {
     if (!this.isTracked(document)) return false;
     if (opts?.expectedVersion !== undefined && document.version !== opts.expectedVersion) return false;
@@ -290,15 +290,25 @@ export class AttributionController implements vscode.Disposable {
         "(host minimized differently?) — the edit may be mis-attributed (INV-9).",
       );
     }
-    if (ok) {
-      // F6 (INV-18): a real machine landing — signal the baseline to advance so
-      // this text never shows as a change in the diff view. Fire regardless of
-      // attribution-match bookkeeping above; the landing happened either way.
+    if (ok && opts?.landBaseline !== false) {
+      // F6 (INV-18): a real machine landing — advance the baseline. F12 (INV-48)
+      // suppresses this for optimistic apply: the proposed text is in the buffer
+      // but the change stays PENDING (baseline at pre-proposal) until accept.
       this.applyEmitter.fire({ document });
     }
     return ok;
   }
 
+  /**
+   * F12/#64 (INV-51): fire the machine-landing signal WITHOUT applying text — used
+   * by finalize-in-place, where the proposed text already landed in the buffer via
+   * optimistic apply (`landBaseline:false`) and accept only needs to advance the
+   * F6 baseline so the now-accepted change stops reading as pending.
+   */
+  signalLanded(document: vscode.TextDocument): void {
+    if (this.isTracked(document)) this.applyEmitter.fire({ document });
+  }
+
   // ---- PUC-4: persistence on save ----------------------------------------------------
 
   private onDidSave(document: vscode.TextDocument): void {

src/editorProposalController.ts

@@ -0,0 +1,151 @@
+/**
+ * EditorProposalController — F12/#64 editor surface (spec coauthoring-inline-editor-diff
+ * §3.5). Reverses INV-32 for pending proposals: on `onDidChangeProposals` it
+ * (1) optimistically applies any not-yet-applied proposal into the active editor's
+ * buffer (ProposalController.optimisticApply, INV-48), (2) decorates each applied
+ * proposal — insertion tint over the proposed text + a non-editable struck-red hint
+ * for deletions (INV-52, decorationPlan/INV-49), and (3) provides a CodeLens
+ * `Accept ▾ / Reject ▾` above each block whose ▾ opens a QuickPick (this / all).
+ * Owns no proposal STATE — it is a view over ProposalController (which stays the
+ * pure F4 owner). A document with no pending proposals shows nothing (INV-32's
+ * spirit when nothing is pending).
+ */
+import * as vscode from "vscode";
+import type { ProposalController } from "./proposalController";
+import { decorationPlan } from "./trackChangesModel";
+import { isAuthorable } from "./workspacePath";
+
+export class EditorProposalController implements vscode.Disposable, vscode.CodeLensProvider {
+  private readonly disposables: vscode.Disposable[] = [];
+  private readonly insertionDeco = vscode.window.createTextEditorDecorationType({
+    backgroundColor: new vscode.ThemeColor("diffEditor.insertedTextBackground"),
+  });
+  private readonly deletionDeco = vscode.window.createTextEditorDecorationType({
+    // a non-editable struck-red hint injected AFTER the insertion (INV-52)
+    after: { color: new vscode.ThemeColor("gitDecoration.deletedResourceForeground") },
+    textDecoration: "none",
+  });
+  private readonly lensEmitter = new vscode.EventEmitter<void>();
+  readonly onDidChangeCodeLenses = this.lensEmitter.event;
+  /** Pending debounce timers — one per URI — coalesce rapid-fire propose events
+   * (e.g. runEditAndPropose's N sequential propose() calls) into a single
+   * optimistic-apply pass that runs after ALL proposals are created. Without this,
+   * each propose() fires onDidChangeProposals synchronously and the controller's
+   * optimisticApply runs concurrently with the still-in-progress propose loop,
+   * causing "file changed in the meantime" workspace-edit conflicts. */
+  private readonly pendingApply = new Map<string, ReturnType<typeof setTimeout>>();
+
+  constructor(private readonly proposals: ProposalController) {
+    this.disposables.push(
+      this.insertionDeco, this.deletionDeco, this.lensEmitter,
+      vscode.languages.registerCodeLensProvider({ language: "markdown" }, this),
+      this.proposals.onDidChangeProposals(({ uri }) => this.scheduleApply(uri)),
+      vscode.window.onDidChangeActiveTextEditor((ed) => ed && this.renderEditor(ed)),
+      // the four QuickPick-backed menu commands
+      vscode.commands.registerCommand("cowriting.proposalAcceptMenu", (id?: string) => this.menu("accept", id)),
+      vscode.commands.registerCommand("cowriting.proposalRejectMenu", (id?: string) => this.menu("reject", id)),
+    );
+  }
+
+  /** Debounce-schedule an optimistic-apply pass for the given URI. Multiple rapid
+   * onDidChangeProposals events (from a single runEditAndPropose batch) collapse
+   * into one pass that runs after the batch completes. */
+  private scheduleApply(uri: string): void {
+    const prev = this.pendingApply.get(uri);
+    if (prev !== undefined) clearTimeout(prev);
+    this.pendingApply.set(
+      uri,
+      setTimeout(() => {
+        this.pendingApply.delete(uri);
+        void this.onProposalsChanged(uri);
+      }, 0),
+    );
+  }
+
+  /** Apply any not-yet-applied proposals on the doc, then re-decorate + refresh lenses. */
+  private async onProposalsChanged(uri: string): Promise<void> {
+    const doc = vscode.workspace.textDocuments.find((d) => d.uri.toString() === uri);
+    if (!doc || doc.languageId !== "markdown" || !isAuthorable(doc.uri.scheme)) return;
+    const key = this.proposals.keyFor(doc);
+    for (const v of this.proposals.listProposals(doc)) {
+      if (v.anchorStart !== null && !this.proposals.isApplied(key, v.id)) {
+        await this.proposals.optimisticApply(doc, v.id); // fires onDidChangeProposals again; guarded by isApplied
+      }
+    }
+    const ed = vscode.window.visibleTextEditors.find((e) => e.document.uri.toString() === uri);
+    if (ed) this.renderEditor(ed);
+    this.lensEmitter.fire();
+  }
+
+  /** Decorate the editor for every applied proposal on its document (INV-52). */
+  private renderEditor(editor: vscode.TextEditor): void {
+    const doc = editor.document;
+    if (doc.languageId !== "markdown") {
+      editor.setDecorations(this.insertionDeco, []);
+      editor.setDecorations(this.deletionDeco, []);
+      return;
+    }
+    const key = this.proposals.keyFor(doc);
+    const insertions: vscode.Range[] = [];
+    const deletions: vscode.DecorationOptions[] = [];
+    for (const v of this.proposals.listProposals(doc)) {
+      if (v.anchorStart === null || v.original === undefined || !this.proposals.isApplied(key, v.id)) continue;
+      const plan = decorationPlan(v.anchorStart, v.original, v.replacement);
+      for (const ins of plan.insertions) {
+        insertions.push(new vscode.Range(doc.positionAt(ins.start), doc.positionAt(ins.end)));
+      }
+      for (const del of plan.deletions) {
+        deletions.push({
+          range: new vscode.Range(doc.positionAt(del.at), doc.positionAt(del.at)),
+          renderOptions: { after: { contentText: ` ${del.text} `, textDecoration: "line-through" } },
+        });
+      }
+    }
+    editor.setDecorations(this.insertionDeco, insertions);
+    editor.setDecorations(this.deletionDeco, deletions);
+  }
+
+  /** CodeLensProvider: a `Accept ▾` / `Reject ▾` pair above each applied block. */
+  provideCodeLenses(document: vscode.TextDocument): vscode.CodeLens[] {
+    if (document.languageId !== "markdown") return [];
+    const key = this.proposals.keyFor(document);
+    const lenses: vscode.CodeLens[] = [];
+    for (const v of this.proposals.listProposals(document)) {
+      if (v.anchorStart === null || !this.proposals.isApplied(key, v.id)) continue;
+      const pos = document.positionAt(v.anchorStart);
+      const line = new vscode.Range(pos.line, 0, pos.line, 0);
+      lenses.push(
+        new vscode.CodeLens(line, { title: "Accept ▾", command: "cowriting.proposalAcceptMenu", arguments: [v.id] }),
+        new vscode.CodeLens(line, { title: "Reject ▾", command: "cowriting.proposalRejectMenu", arguments: [v.id] }),
+      );
+    }
+    return lenses;
+  }
+
+  /** The dropdown: this-proposal vs all-proposals, then dispatch. */
+  private async menu(kind: "accept" | "reject", id?: string): Promise<void> {
+    const doc = vscode.window.activeTextEditor?.document;
+    if (!doc || !id) return;
+    const key = this.proposals.keyFor(doc);
+    const verb = kind === "accept" ? "Accept" : "Reject";
+    const pick = await vscode.window.showQuickPick(
+      [`${verb} this proposal`, `${verb} ALL proposals`],
+      { placeHolder: `${verb} Claude's proposal` },
+    );
+    if (!pick) return;
+    const all = pick.includes("ALL");
+    if (kind === "accept") {
+      if (all) await this.proposals.acceptAllProposals(doc);
+      else await this.proposals.finalizeInPlace(key, id);
+    } else {
+      if (all) await this.proposals.rejectAll(doc);
+      else await this.proposals.revertInPlace(key, id);
+    }
+  }
+
+  dispose(): void {
+    for (const t of this.pendingApply.values()) clearTimeout(t);
+    this.pendingApply.clear();
+    for (const d of this.disposables) d.dispose();
+  }
+}

src/extension.ts

@@ -13,6 +13,7 @@ import { DiffViewController } from "./diffViewController";
 import { TrackChangesPreviewController } from "./trackChangesPreview";
 import { LiveProgressUi } from "./liveProgressUi";
 import { InlineAskController } from "./inlineAsk";
+import { EditorProposalController } from "./editorProposalController";
 import { isAuthorable, routeEdit, selectionRejection } from "./workspacePath";
 
 const CHANNEL_NAME = "Cowriting (Cline SDK)";
@@ -27,6 +28,7 @@ export interface CowritingApi {
   sidecarRouter: SidecarRouter;
   liveProgressUi: LiveProgressUi;
   inlineAsk: InlineAskController;
+  editorProposalController: EditorProposalController;
 }
 
 export function activate(context: vscode.ExtensionContext): CowritingApi | undefined {
@@ -123,6 +125,11 @@ export function activate(context: vscode.ExtensionContext): CowritingApi | undef
   );
   context.subscriptions.push(trackChangesPreviewController);
 
+  // --- F12 (#64): the editor surface — optimistic-apply proposals into the buffer,
+  // decorate the diff, and provide Accept ▾/Reject ▾ CodeLens (INV-48/49/52/53). ---
+  const editorProposalController = new EditorProposalController(proposalController);
+  context.subscriptions.push(editorProposalController);
+
   // #46 (INV-42): accept every pending proposal on the active doc in one gesture
   // (also reachable from the preview toolbar's "Accept all" button). Reuses the
   // batched F4 seam + reports applied-vs-skipped.
@@ -137,6 +144,18 @@ export function activate(context: vscode.ExtensionContext): CowritingApi | undef
     }),
   );
 
+  // #64 (INV-53): reject every pending proposal on the active doc in one gesture.
+  context.subscriptions.push(
+    vscode.commands.registerCommand("cowriting.rejectAllProposals", async () => {
+      const doc = vscode.window.activeTextEditor?.document;
+      if (!doc || doc.languageId !== "markdown") {
+        void vscode.window.showWarningMessage("Cowriting: open a Markdown document to reject its proposals.");
+        return;
+      }
+      await trackChangesPreviewController.rejectAll(doc);
+    }),
+  );
+
   // --- F6 machine-landing wiring — now for ANY authorable doc ---
   // The seam's single machine-landing signal advances the F6 baseline (INV-18);
   // the seam can now fire on out-of-folder files too, so wire it unconditionally.
@@ -345,6 +364,7 @@ export function activate(context: vscode.ExtensionContext): CowritingApi | undef
     sidecarRouter,
     liveProgressUi,
     inlineAsk,
+    editorProposalController,
   };
 }
 

src/proposalController.ts

@@ -13,8 +13,8 @@
 import * as vscode from "vscode";
 import { SidecarRouter, docIdentity } from "./sidecarRouter";
 import { emptyArtifact, type Artifact, type Fingerprint, type Proposal, type Provenance } from "./model";
-import { resolve, shift, type OffsetRange } from "./anchorer";
-import { addProposal, removeProposal } from "./proposalModel";
+import { resolve, shift, buildFingerprint, type OffsetRange } from "./anchorer";
+import { addProposal, removeProposal, setProposalApplied } from "./proposalModel";
 import type { AttributionController } from "./attributionController";
 import type { VersionGuard } from "./versionGuard";
 import { isAuthorable } from "./workspacePath";
@@ -39,6 +39,8 @@ interface DocState {
   live: Map<string, OffsetRange>;
   /** proposal ids whose anchor did not resolve at last render (stale/orphaned). */
   unresolved: Set<string>;
+  /** ids already optimistically applied to the buffer (so the trigger doesn't re-apply). */
+  applied: Set<string>;
 }
 
 export class ProposalController implements vscode.Disposable {
@@ -89,8 +91,9 @@ export class ProposalController implements vscode.Disposable {
         id: p.id,
         anchorStart: resolved === "orphaned" ? null : resolved.start,
         anchorEnd: resolved === "orphaned" ? null : resolved.end,
-        replaced: fp?.text ?? "",
+        replaced: p.original ?? fp?.text ?? "",
         replacement: p.replacement,
+        original: p.original,
       };
     });
   }
@@ -104,6 +107,7 @@ export class ProposalController implements vscode.Disposable {
         artifact: this.store.load(docPath) ?? emptyArtifact(docPath),
         live: new Map(),
         unresolved: new Set(),
+        applied: new Set(),
       };
       this.docs.set(docPath, state);
     }
@@ -137,8 +141,33 @@ export class ProposalController implements vscode.Disposable {
 
   // ---- PUC-2/PUC-3: accept / reject (INV-11/INV-12) ----------------------------------
 
-  /** Accept by proposal id (test-facing twin of the thread-menu gesture). */
+  /** Accept by id — F12: finalize the already-applied text in place (INV-51). */
   async acceptById(docPath: string, proposalId: string, opts?: { silent?: boolean }): Promise<boolean> {
+    if (this.isApplied(docPath, proposalId)) {
+      // INV-11 (applied path): if an external write mangled the optimistically-applied
+      // text so the fingerprint no longer resolves, refuse finalize — same guard as the
+      // legacy accept path.  Direct finalizeInPlace calls (CodeLens Accept gesture where
+      // the user may have edited inside the applied span) bypass this check intentionally.
+      const hit = this.byId(docPath, proposalId);
+      if (hit) {
+        const document = this.openDoc(hit.state);
+        if (document) {
+          const fp = hit.state.artifact.anchors[hit.proposal.anchorId]?.fingerprint;
+          const resolved = fp ? resolve(document.getText(), fp) : "orphaned";
+          if (resolved === "orphaned") {
+            if (!opts?.silent) {
+              void vscode.window.showWarningMessage(
+                "Cowriting: this proposal's target text changed or is missing — undo to restore it, or reject to discard (it is never applied by guess).",
+              );
+            }
+            return false;
+          }
+        }
+      }
+      return this.finalizeInPlace(docPath, proposalId);
+    }
+    // Fallback: a proposal that was never optimistically applied (e.g. orphaned at
+    // apply time) keeps the legacy seam-apply accept.
     const hit = this.byId(docPath, proposalId);
     return hit ? this.accept(hit.state, hit.proposal, opts) : false;
   }
@@ -181,6 +210,12 @@ export class ProposalController implements vscode.Disposable {
     return true;
   }
 
+  /** Reject by id — F12: revert the applied text in place (INV-51). */
+  async rejectByIdInPlace(docPath: string, proposalId: string): Promise<boolean> {
+    if (this.isApplied(docPath, proposalId)) return this.revertInPlace(docPath, proposalId);
+    return this.rejectById(docPath, proposalId);
+  }
+
   private async accept(state: DocState, proposal: Proposal, opts?: { silent?: boolean }): Promise<boolean> {
     if (this.guard.isReadOnly(state.docPath)) return false;
     const document = this.openDoc(state);
@@ -257,6 +292,158 @@ export class ProposalController implements vscode.Disposable {
     return true;
   }
 
+  /** True once this proposal's text is in the buffer (optimistic apply ran). */
+  isApplied(docPath: string, proposalId: string): boolean {
+    return this.docs.get(docPath)?.applied.has(proposalId) ?? false;
+  }
+
+  /**
+   * F12/#64 (INV-48): optimistically apply a pending proposal INTO the buffer so
+   * the editor shows the would-be-accepted result (editable). Reuses the F4
+   * word-precise seam (block → per-word hunks, INV-40; single → whole range) but
+   * with `landBaseline:false` (the change stays pending). Then re-anchors the
+   * proposal to the applied text and stores the original (`setProposalApplied`), so
+   * `resolve()` finds it in the mutated buffer and revert/decorate key off it.
+   * Idempotent: a no-op if already applied.
+   */
+  async optimisticApply(document: vscode.TextDocument, proposalId: string): Promise<boolean> {
+    if (!this.isTracked(document) || this.guard.isReadOnly(this.keyOf(document))) return false;
+    const docPath = this.keyOf(document);
+    const state = this.ensureState(document);
+    if (state.applied.has(proposalId)) return true;
+    state.artifact = this.store.load(docPath) ?? emptyArtifact(docPath);
+    const proposal = state.artifact.proposals.find((p) => p.id === proposalId);
+    const fp = proposal ? state.artifact.anchors[proposal.anchorId]?.fingerprint : undefined;
+    if (!proposal || !fp) return false;
+    // Reload-safety (INV-51/54): a proposal that already carries `original` was
+    // optimistically applied in a PRIOR session — the buffer holds the applied text
+    // and `fp` points at it, but this (fresh) controller's in-memory `applied` set is
+    // empty. Re-applying would recapture `original` from the already-applied buffer
+    // (= the replacement) and CLOBBER the true revert target, breaking Reject. Mark it
+    // applied in memory and stop — `original` is captured exactly once, on first apply.
+    if (proposal.original !== undefined) {
+      state.applied.add(proposalId);
+      this.renderAll(document);
+      return true;
+    }
+    const resolved = resolve(document.getText(), fp);
+    if (resolved === "orphaned") return false;
+    const original = document.getText(
+      new vscode.Range(document.positionAt(resolved.start), document.positionAt(resolved.end)),
+    );
+    const ok =
+      proposal.granularity === "block"
+        ? await this.applyBlockOptimistic(document, resolved, proposal)
+        : await this.attribution.applyAgentEdit(
+            document,
+            new vscode.Range(document.positionAt(resolved.start), document.positionAt(resolved.end)),
+            proposal.replacement,
+            proposal.author,
+            { expectedVersion: document.version, turnId: proposal.turnId, landBaseline: false },
+          );
+    if (!ok) return false;
+    state.applied.add(proposalId);
+    // Re-anchor to the applied text now in the buffer (its start is unchanged; its
+    // end shifts by the net length delta of the replacement).
+    const appliedStart = resolved.start;
+    const appliedEnd = appliedStart + proposal.replacement.length;
+    const appliedFp = buildFingerprint(document.getText(), { start: appliedStart, end: appliedEnd });
+    this.store.update(docPath, (a) => setProposalApplied(a, proposalId, appliedFp, original));
+    this.renderAll(document);
+    return true;
+  }
+
+  /** Block optimistic apply: the INV-40 per-word hunks, but landBaseline:false. */
+  private async applyBlockOptimistic(
+    document: vscode.TextDocument,
+    resolved: OffsetRange,
+    proposal: Proposal,
+  ): Promise<boolean> {
+    const blockText = document.getText(
+      new vscode.Range(document.positionAt(resolved.start), document.positionAt(resolved.end)),
+    );
+    const subHunks = wordEditHunks(blockText, proposal.replacement);
+    if (subHunks.length === 0) return true;
+    for (const h of [...subHunks].sort((a, b) => b.start - a.start)) {
+      const range = new vscode.Range(
+        document.positionAt(resolved.start + h.start),
+        document.positionAt(resolved.start + h.end),
+      );
+      const ok = await this.attribution.applyAgentEdit(document, range, h.replacement, proposal.author, {
+        expectedVersion: document.version, turnId: proposal.turnId, landBaseline: false,
+      });
+      if (!ok) return false;
+    }
+    return true;
+  }
+
+  /**
+   * F12/#64 (INV-51): ACCEPT an optimistically-applied proposal — the text is
+   * already in the buffer, so this only advances the F6 baseline (machine-landing,
+   * via `attribution.signalLanded`) and clears the proposal. No re-application.
+   */
+  async finalizeInPlace(docPath: string, proposalId: string): Promise<boolean> {
+    const hit = this.byId(docPath, proposalId);
+    if (!hit) return false;
+    const document = this.openDoc(hit.state);
+    if (!document) return false;
+    this.attribution.signalLanded(document);
+    this.store.update(docPath, (a) => removeProposal(a, proposalId));
+    hit.state.applied.delete(proposalId);
+    this.renderAll(document);
+    return true;
+  }
+
+  /**
+   * F12/#64 (INV-51): REJECT an optimistically-applied proposal — replace its live
+   * applied span with the stored `original`, then clear it. Reverts the whole block
+   * regardless of any in-place edits the human made to the inserted text.
+   */
+  async revertInPlace(docPath: string, proposalId: string): Promise<boolean> {
+    const hit = this.byId(docPath, proposalId);
+    if (!hit) return false;
+    const document = this.openDoc(hit.state);
+    if (!document) return false;
+    const fp = hit.state.artifact.anchors[hit.proposal.anchorId]?.fingerprint;
+    const resolved = fp ? resolve(document.getText(), fp) : "orphaned";
+    if (resolved !== "orphaned" && hit.proposal.original !== undefined) {
+      const we = new vscode.WorkspaceEdit();
+      we.replace(
+        document.uri,
+        new vscode.Range(document.positionAt(resolved.start), document.positionAt(resolved.end)),
+        hit.proposal.original,
+      );
+      if (!(await vscode.workspace.applyEdit(we))) return false;
+    }
+    this.store.update(docPath, (a) => removeProposal(a, proposalId));
+    hit.state.applied.delete(proposalId);
+    this.renderAll(document);
+    return true;
+  }
+
+  /**
+   * F12/#64 (INV-53): reject EVERY pending proposal on a document — revert each in
+   * DESCENDING anchor order (so an earlier revert never shifts a later one's
+   * offsets), symmetric with #46's accept-all. Returns the reverted count.
+   */
+  async rejectAll(document: vscode.TextDocument): Promise<{ reverted: number }> {
+    if (!this.isTracked(document)) return { reverted: 0 };
+    const docPath = this.keyOf(document);
+    const state = this.ensureState(document);
+    state.artifact = this.store.load(docPath) ?? emptyArtifact(docPath);
+    const text = document.getText();
+    const ordered = state.artifact.proposals
+      .map((p) => {
+        const fp = state.artifact.anchors[p.anchorId]?.fingerprint;
+        const r = fp ? resolve(text, fp) : "orphaned";
+        return { id: p.id, start: r === "orphaned" ? -1 : r.start };
+      })
+      .sort((a, b) => b.start - a.start);
+    let reverted = 0;
+    for (const it of ordered) if (await this.revertInPlace(docPath, it.id)) reverted++;
+    return { reverted };
+  }
+
   private reject(state: DocState, proposal: Proposal): void {
     if (this.guard.isReadOnly(state.docPath)) return;
     this.store.update(state.docPath, (a) => removeProposal(a, proposal.id));

src/proposalModel.ts

@@ -37,6 +37,25 @@ export function removeProposal(artifact: Artifact, proposalId: string): boolean
   return artifact.proposals.length < before;
 }
 
+/**
+ * F12/#64 (INV-48): record a proposal as optimistically applied — store the
+ * pre-apply `original` (for revert + the struck `<del>`) and re-point its anchor
+ * fingerprint to the now-in-buffer applied text so `resolve()` finds it. Idempotent
+ * shape: a second call simply overwrites with the same values.
+ */
+export function setProposalApplied(
+  artifact: Artifact,
+  proposalId: string,
+  appliedFp: Fingerprint,
+  original: string,
+): boolean {
+  const p = artifact.proposals.find((x) => x.id === proposalId);
+  if (!p) return false;
+  p.original = original;
+  artifact.anchors[p.anchorId] = { fingerprint: appliedFp };
+  return true;
+}
+
 /** Markdown comment body: instruction header + fenced whole-range diff. */
 export function proposalBody(targetText: string, p: Proposal): string {
   const header = p.instruction ? `**Claude proposes** — _${p.instruction}_` : "**Claude proposes**";

src/trackChangesModel.ts

@@ -263,6 +263,42 @@ export function wordEditHunks(currentText: string, rewrittenText: string): EditH
   return hunks;
 }
 
+/** F12/#64 (INV-49/52): the editor render of one optimistically-applied proposal. */
+export interface DecorationPlan {
+  /** buffer ranges of inserted (proposed) text → tinted (INV-52). */
+  insertions: { start: number; end: number }[];
+  /** struck original text shown as a non-editable hint at a buffer offset (INV-52). */
+  deletions: { at: number; text: string }[];
+}
+
+/**
+ * F12/#64 (INV-49): compute the editor decoration plan for a proposal whose applied
+ * text occupies `[anchorStart, anchorStart+replacement.length)` in the buffer. The
+ * SAME word diff the webview uses (`wordEditHunks`) drives it, so both surfaces show
+ * the identical diff. A changed run maps to (a) an insertion range over the run's
+ * applied text and (b) a deletion hint carrying the run's removed original text at
+ * the run start; a pure insertion has no deletion hint; a pure deletion has only a
+ * hint. Pure, vscode-free, deterministic.
+ */
+export function decorationPlan(anchorStart: number, original: string, replacement: string): DecorationPlan {
+  const insertions: { start: number; end: number }[] = [];
+  const deletions: { at: number; text: string }[] = [];
+  // Walk the word diff once, tracking the applied-side offset as we consume parts.
+  let appliedOffset = anchorStart;
+  for (const part of diffWordsWithSpace(original, replacement)) {
+    if (part.added) {
+      insertions.push({ start: appliedOffset, end: appliedOffset + part.value.length });
+      appliedOffset += part.value.length;
+    } else if (part.removed) {
+      deletions.push({ at: appliedOffset, text: part.value });
+      // removed text is NOT in the applied buffer → appliedOffset does not advance
+    } else {
+      appliedOffset += part.value.length;
+    }
+  }
+  return { insertions, deletions };
+}
+
 const isWs = (c: string): boolean => /\s/.test(c);
 
 /**
@@ -701,6 +737,8 @@ export interface ProposalView {
   replaced: string;
   /** the proposed replacement text. */
   replacement: string;
+  /** F12/#64 (INV-48): the pre-apply original, set after optimistic apply. */
+  original?: string;
 }
 
 function proposalBlockHtml(p: ProposalView, render: (src: string) => string): string {
@@ -716,8 +754,14 @@ function proposalBlockHtml(p: ProposalView, render: (src: string) => string): st
   const after = `<ins class="cw-add">${safe(p.replacement)}</ins>`;
   const actions =
     `<span class="cw-actions">` +
-    `<button class="cw-accept" data-action="accept">✓</button>` +
-    `<button class="cw-reject" data-action="reject">✗</button>` +
+    `<span class="cw-btngroup">` +
+    `<button class="cw-accept" data-action="accept">Accept</button>` +
+    `<button class="cw-caret" data-action="acceptAll" title="Accept all pending proposals">▾</button>` +
+    `</span>` +
+    `<span class="cw-btngroup">` +
+    `<button class="cw-reject" data-action="reject">Reject</button>` +
+    `<button class="cw-caret" data-action="rejectAll" title="Reject all pending proposals">▾</button>` +
+    `</span>` +
     `</span>`;
   return `<div class="cw-proposal${unanchored}" data-proposal-id="${md.utils.escapeHtml(p.id)}">${actions}${before}${after}</div>`;
 }
@@ -747,6 +791,26 @@ function renderReviewOp(
  * INV-34). Deterministic: proposals in the same block are ordered by anchorStart
  * then id; trailing proposals keep input order.
  */
+/**
+ * F12/#64 (INV-50): `currentText` with every resolved pending proposal's applied
+ * span reverted to its original (`replaced`) — the "landed" text the baseline diff
+ * should run against, so a pending proposal renders ONCE (as a proposal), never also
+ * as a landed change. Reverts high→low so earlier offsets stay valid. Pure. The
+ * preview's summary tally diffs against this too, so the toolbar count matches the
+ * body (a pending change is not double-counted as both a landed add/remove and a
+ * proposal).
+ */
+export function landedTextOf(currentText: string, proposals: ProposalView[]): string {
+  const pendingApplied = proposals
+    .filter((p) => p.anchorStart !== null)
+    .sort((a, b) => b.anchorStart! - a.anchorStart!);
+  let landedText = currentText;
+  for (const p of pendingApplied) {
+    landedText = landedText.slice(0, p.anchorStart!) + p.replaced + landedText.slice(p.anchorEnd!);
+  }
+  return landedText;
+}
+
 export function renderReview(
   baselineText: string,
   currentText: string,
@@ -755,8 +819,18 @@ export function renderReview(
   opts: RenderOptions = {},
 ): string {
   const render = opts.render ?? defaultRender;
-  const ranges = splitBlocksWithRanges(currentText);
-  const ops = diffBlocks(baselineText, currentText);
+
+  // F12/#64 (INV-50): with optimistic apply the proposed text is already in
+  // `currentText`, so a naive baseline→current diff would render each proposed
+  // change BOTH as a landed diff and as its proposal block. Diff against the
+  // "landed" text (current minus pending proposals) so they render once.
+  const pendingApplied = proposals
+    .filter((p) => p.anchorStart !== null)
+    .sort((a, b) => b.anchorStart! - a.anchorStart!);
+  const landedText = landedTextOf(currentText, proposals);
+
+  const ranges = splitBlocksWithRanges(landedText);
+  const ops = diffBlocks(baselineText, landedText);
   // #48: right after a PIN (baseline reason "pinned") with no changes since, the
   // panel is fully clean: no change marks (already absent) AND no authorship
   // coloring, so the pin reads as "this is my clean starting point". Skip
@@ -766,7 +840,28 @@ export function renderReview(
   // its authorship coloring (F10 INV-33), so this is gated on the pin specifically.
   const clean = opts.pinned === true && ops.every((o) => o.kind === "unchanged");
 
-  // Associate each resolved proposal with the current-side block index whose range
+  // Map a currentText offset to its landedText offset (account for reverted spans
+  // that precede it; reverts were applied high→low so the cumulative delta is stable).
+  const toLanded = (curOff: number): number => {
+    let delta = 0;
+    for (const p of [...pendingApplied].sort((a, b) => a.anchorStart! - b.anchorStart!)) {
+      if (p.anchorStart! < curOff) delta += p.replaced.length - (p.anchorEnd! - p.anchorStart!);
+    }
+    return curOff + delta;
+  };
+
+  // F12/#64 (INV-49/50): blocks are split from `landedText`, so `blk.start` is a
+  // landedText offset — but `authorSpans` arrive in `currentText` coordinates. A
+  // colored block sitting AFTER a length-changing pending proposal would otherwise
+  // be mis-colored (the offsets diverge by the revert delta). Map the spans into
+  // landedText coordinates once so authorship coloring stays aligned.
+  const landedSpans: AuthorSpan[] = authorSpans.map((s) => ({
+    ...s,
+    start: toLanded(s.start),
+    end: toLanded(s.end),
+  }));
+
+  // Associate each resolved proposal with the landedText block index whose range
   // it anchors into: the largest block with start <= anchorStart (the containing
   // block, or the nearest preceding block when the anchor sits in a gap). A
   // resolved anchor before all blocks, and every unresolved proposal, trails.
@@ -778,7 +873,7 @@ export function renderReview(
   const byBlock = new Map<number, ProposalView[]>();
   const trailing: ProposalView[] = [];
   for (const p of proposals) {
-    const j = p.anchorStart === null ? -1 : blockOf(p.anchorStart);
+    const j = p.anchorStart === null ? -1 : blockOf(toLanded(p.anchorStart));
     if (j < 0) {
       trailing.push(p);
       continue;
@@ -795,7 +890,7 @@ export function renderReview(
     const blockIndex = op.kind === "removed" ? -1 : ci;
     const blk = op.kind === "removed" ? undefined : ranges[ci++];
     const colored = (raw: string): string =>
-      blk && !clean ? colorByAuthor(raw, blk.start, authorSpans, render) : render(raw);
+      blk && !clean ? colorByAuthor(raw, blk.start, landedSpans, render) : render(raw);
     bodyParts.push(renderReviewOp(op, render, colored, srcAttr(blk)));
     const here = blockIndex >= 0 ? byBlock.get(blockIndex) : undefined;
     if (here) for (const p of here) bodyParts.push(proposalBlockHtml(p, render));

src/trackChangesPreview.ts

@@ -13,7 +13,7 @@ import * as vscode from "vscode";
 import type { DiffViewController } from "./diffViewController";
 import type { AttributionController } from "./attributionController";
 import type { ProposalController } from "./proposalController";
-import { renderReview, renderPlain, diffBlocks, diffToBlockHunks, type BlockOp } from "./trackChangesModel";
+import { renderReview, renderPlain, diffBlocks, diffToBlockHunks, landedTextOf, type BlockOp } from "./trackChangesModel";
 import { buildFingerprint } from "./anchorer";
 import { isAuthorable } from "./workspacePath";
 import type { EditTurnResult, RunEditTurnOptions } from "./liveTurn";
@@ -44,7 +44,8 @@ type ToolbarMsg =
   | { type: "pinBaseline" }
   | { type: "askClaude"; scope: "document" }
   | { type: "askClaude"; scope: "selection"; start: number; end: number }
-  | { type: "acceptAll" };
+  | { type: "acceptAll" }
+  | { type: "rejectAll" };
 
 export class TrackChangesPreviewController implements vscode.Disposable {
   private readonly disposables: vscode.Disposable[] = [];
@@ -190,8 +191,7 @@ export class TrackChangesPreviewController implements vscode.Disposable {
         .acceptById(this.proposals.keyFor(document), m.proposalId)
         .then(() => this.refresh(document));
     } else if (m?.type === "reject" && m.proposalId) {
-      this.proposals.rejectById(this.proposals.keyFor(document), m.proposalId);
-      this.refresh(document);
+      void this.proposals.rejectByIdInPlace(this.proposals.keyFor(document), m.proposalId).then(() => this.refresh(document));
     } else if (m?.type === "pinBaseline") {
       // F6 baseline store re-render arrives via the onDidChangeBaseline subscription.
       this.diffView.pin(document);
@@ -202,6 +202,8 @@ export class TrackChangesPreviewController implements vscode.Disposable {
     } else if (m?.type === "acceptAll") {
       // #46 (INV-42): batch-accept every pending proposal on this doc, then report.
       void this.acceptAll(document);
+    } else if (m?.type === "rejectAll") {
+      void this.rejectAll(document);
     }
   }
 
@@ -222,6 +224,17 @@ export class TrackChangesPreviewController implements vscode.Disposable {
     );
   }
 
+  /** #64 (INV-53): revert every pending proposal on the document; report the count. */
+  async rejectAll(document: vscode.TextDocument): Promise<void> {
+    const { reverted } = await this.proposals.rejectAll(document);
+    this.refresh(document);
+    if (reverted > 0) {
+      void vscode.window.showInformationMessage(
+        `Cowriting: rejected ${reverted} proposal${reverted === 1 ? "" : "s"}.`,
+      );
+    }
+  }
+
   /**
    * Where the inline Ask-Claude input anchors: a range edit pins to its selection;
    * a whole-document edit pins to the editor's cursor line if this document is the
@@ -369,9 +382,13 @@ export class TrackChangesPreviewController implements vscode.Disposable {
     }
     const spans = this.attribution.spansFor(document);
     const proposals = this.proposals.listProposals(document);
+    // F12/#64 (INV-50): count added/removed against the LANDED text (current minus
+    // pending proposals), matching the body — a pending change shows once, as a
+    // proposal, and is not also tallied as a landed add/remove.
+    const landedOps = diffBlocks(baselineText, landedTextOf(current, proposals));
     const summary = {
-      added: ops.filter((o) => o.kind === "added").length,
-      removed: ops.filter((o) => o.kind === "removed").length,
+      added: landedOps.filter((o) => o.kind === "added").length,
+      removed: landedOps.filter((o) => o.kind === "removed").length,
       proposals: proposals.length,
     };
     void panel.webview.postMessage({

test/decorationPlan.test.ts

@@ -0,0 +1,27 @@
+import { describe, test, expect } from "vitest";
+import { decorationPlan } from "../src/trackChangesModel";
+
+describe("decorationPlan (INV-49)", () => {
+  test("derives insertion ranges + deletion hints from original→replacement", () => {
+    // anchorStart 10; original 'the brown fox' → 'the red fox'
+    const plan = decorationPlan(10, "the brown fox", "the red fox");
+    // one changed run: 'brown ' → 'red ' (word-level); insertion 'red ' tinted,
+    // deletion hint 'brown ' shown at the run start.
+    expect(plan.insertions.length).toBeGreaterThan(0);
+    expect(plan.deletions.length).toBeGreaterThan(0);
+    // insertion offsets are in buffer coords (>= anchorStart) and lie within the applied text
+    for (const ins of plan.insertions) {
+      expect(ins.start).toBeGreaterThanOrEqual(10);
+      expect(ins.end).toBeLessThanOrEqual(10 + "the red fox".length);
+    }
+    // a deletion hint carries the struck original text at a buffer offset
+    expect(plan.deletions[0].text).toContain("brown");
+  });
+
+  test("pure insertion (no deletion) yields an insertion range and no deletion hint", () => {
+    // 'hello' → 'hello world': ' world' is a pure word-level insertion (no removed tokens)
+    const plan = decorationPlan(0, "hello", "hello world");
+    expect(plan.insertions.length).toBe(1);
+    expect(plan.deletions.length).toBe(0);
+  });
+});

test/e2e/runTest.ts

@@ -13,11 +13,20 @@ async function main(): Promise<void> {
   const workspace = fs.mkdtempSync(path.join(os.tmpdir(), "cowriting-e2e-"));
   fs.cpSync(fixture, workspace, { recursive: true });
 
+  // VS Code derives its IPC socket path from --user-data-dir. The default
+  // (`<projectRoot>/.vscode-test/user-data`) plus `/<version>-main.sock` can blow
+  // past macOS's ~103-char UNIX-socket limit (`listen EINVAL`) when the project
+  // lives at a long path (e.g. a git worktree). Pin the user-data dir to a SHORT
+  // root under /tmp so the socket path stays well under the limit. (os.tmpdir() on
+  // macOS is itself a long /var/folders/… path, so we use /tmp directly.)
+  const userDataRoot = process.platform === "win32" ? os.tmpdir() : "/tmp";
+  const userDataDir = fs.mkdtempSync(path.join(userDataRoot, "cwud-"));
+
   try {
     await runTests({
       extensionDevelopmentPath,
       extensionTestsPath,
-      launchArgs: [workspace, "--disable-extensions"],
+      launchArgs: [workspace, "--disable-extensions", "--user-data-dir", userDataDir],
       extensionTestsEnv: { E2E_WORKSPACE: workspace },
     });
 
@@ -26,10 +35,11 @@ async function main(): Promise<void> {
     await runTests({
       extensionDevelopmentPath,
       extensionTestsPath: path.resolve(__dirname, "./suite-no-workspace/index"),
-      launchArgs: ["--disable-extensions"],
+      launchArgs: ["--disable-extensions", "--user-data-dir", userDataDir],
     });
   } finally {
     fs.rmSync(workspace, { recursive: true, force: true });
+    fs.rmSync(userDataDir, { recursive: true, force: true });
   }
 }
 

test/e2e/suite/f10Review.test.ts

@@ -109,8 +109,9 @@ suite("F10 interactive review (host E2E — preview is the single review surface
     const pIdx = html.indexOf(`data-proposal-id="${id}"`);
     const t2Idx = html.indexOf("second claude target");
     assert.ok(t2Idx >= 0 && pIdx < t2Idx, "the proposal renders in place, before the following block (#31)");
-    // INV-10: proposing never touches the document.
-    assert.ok(doc.getText().includes(T1), "document unchanged by propose");
+    // F12 (INV-48): EditorProposalController auto-applies the proposal into the buffer;
+    // the replacement text is now in the document, proposal is still pending.
+    assert.ok(doc.getText().includes("A FIRST claude REPLACEMENT sentence."), "F12 optimistic-apply: replacement in buffer");
   });
 
   test("accept → the proposal lands, clears from the preview, and the baseline advances (PUC-4)", async () => {
@@ -131,17 +132,18 @@ suite("F10 interactive review (host E2E — preview is the single review surface
     assert.ok(!marked, "the just-landed Claude text renders unmarked (baseline advanced)");
   });
 
-  test("reject → the proposal vanishes and the document is untouched (PUC-5)", async () => {
+  test("reject → the proposal vanishes and the document is reverted (PUC-5)", async () => {
     const { doc, key } = await reopen(DOC_REL);
     const api = await getApi();
     const before = doc.getText();
     const id2 = await propose(doc, key, T2, "A SECOND would-be replacement.", "turn-f10-2");
     await settle();
     assert.ok(api.proposalController.listProposals(doc).some((v) => v.id === id2), "second proposal pending");
-    assert.strictEqual(api.proposalController.rejectById(DOC_REL, id2), true, "reject");
+    // F12: use rejectByIdInPlace to revert the optimistically-applied buffer edit.
+    assert.ok(await api.proposalController.rejectByIdInPlace(DOC_REL, id2), "rejectByIdInPlace reverts + removes");
     await settle();
     assert.ok(!api.proposalController.listProposals(doc).some((v) => v.id === id2), "rejected proposal gone");
-    assert.strictEqual(doc.getText(), before, "document untouched by reject");
+    assert.strictEqual(doc.getText(), before, "document reverted to pre-propose state");
     const html = api.trackChangesPreviewController.renderHtmlFor(key);
     assert.ok(!html.includes(`data-proposal-id="${id2}"`), "no rejected block in the preview");
   });

test/e2e/suite/f11Toolbar.test.ts

@@ -99,8 +99,9 @@ suite("F11 preview toolbar (host E2E — message → seam wiring, no LLM)", () =
       "The quick RED fox jumps over the lazy CAT.",
       "the block proposal carries the whole rewritten paragraph",
     );
-    // INV-10: proposing never mutates the document.
-    assert.ok(doc.getText().includes("brown fox") && doc.getText().includes("lazy dog"), "document unchanged by propose");
+    // F12 (INV-48): EditorProposalController optimistically applies the proposed text,
+    // so after settle the buffer has the replacement. The proposal is still pending.
+    assert.ok(doc.getText().includes("RED fox") && doc.getText().includes("lazy CAT"), "F12 optimistic-apply: proposed text in buffer");
     void key;
   });
 
@@ -129,7 +130,9 @@ suite("F11 preview toolbar (host E2E — message → seam wiring, no LLM)", () =
     assert.ok(view, "the proposal is live");
     assert.strictEqual(view!.replacement, "The REWRITTEN paragraph from Claude.", "carries the turn replacement");
     assert.strictEqual(view!.replaced, target, "replaces exactly the selected range");
-    assert.ok(doc.getText().includes(target), "document unchanged by propose (INV-10)");
+    // F12 (INV-48): the EditorProposalController optimistically applies, so the buffer
+    // now has the replacement. `view.replaced` still records the original target text.
+    assert.ok(doc.getText().includes("The REWRITTEN paragraph from Claude."), "F12 optimistic-apply: proposed text in buffer");
     void key;
   });
 

test/e2e/suite/f12InlineDiff.test.ts

@@ -0,0 +1,251 @@
+import * as assert from "assert";
+import * as fs from "fs";
+import * as path from "path";
+import * as vscode from "vscode";
+import type { CowritingApi } from "../../../src/extension";
+import { addProposal, setProposalApplied } from "../../../src/proposalModel";
+import { buildFingerprint } from "../../../src/anchorer";
+
+const WS = process.env.E2E_WORKSPACE!;
+const settle = () => new Promise((r) => setTimeout(r, 400));
+
+async function getApi(): Promise<CowritingApi> {
+  const ext = vscode.extensions.getExtension("benstull.vscode-cowriting-plugin")!;
+  const api = (await ext.activate()) as CowritingApi;
+  assert.ok(api?.trackChangesPreviewController && api?.proposalController, "exports controllers");
+  return api;
+}
+
+async function freshDoc(rel: string, body: string): Promise<{ doc: vscode.TextDocument; key: string }> {
+  const abs = path.join(WS, rel);
+  fs.mkdirSync(path.dirname(abs), { recursive: true });
+  fs.writeFileSync(abs, body, "utf8");
+  const uri = vscode.Uri.file(abs);
+  const doc = await vscode.workspace.openTextDocument(uri);
+  await vscode.window.showTextDocument(doc);
+  await settle();
+  return { doc, key: uri.toString() };
+}
+
+suite("F12 inline diff — seam landBaseline (#64, INV-48)", () => {
+  test("applyAgentEdit with landBaseline:false applies text but does NOT advance the baseline", async () => {
+    const { doc, key } = await freshDoc("docs/f12-land.md", "# T\n\nalpha here.\n");
+    const api = await getApi();
+    await vscode.commands.executeCommand("cowriting.showTrackChangesPreview");
+    await settle();
+    const before = api.diffViewController.getBaseline(key)?.text ?? doc.getText();
+    const start = doc.getText().indexOf("alpha");
+    const ok = await api.attributionController.applyAgentEdit(
+      doc,
+      new vscode.Range(doc.positionAt(start), doc.positionAt(start + "alpha".length)),
+      "ALPHA",
+      { kind: "agent", id: "claude", agent: { sdk: "x", model: "m", sessionId: "s" } },
+      { landBaseline: false },
+    );
+    await settle();
+    assert.ok(ok, "edit applied");
+    assert.ok(doc.getText().includes("ALPHA"), "text in buffer");
+    assert.strictEqual(api.diffViewController.getBaseline(key)?.text ?? doc.getText(), before, "baseline unchanged");
+  });
+});
+
+suite("F12 inline diff — finalize / revert in place (#64, INV-51)", () => {
+  // Optimistic apply lands the text + re-anchors; the buffer becomes the accepted result.
+  test("optimisticApply puts the proposed text in the buffer and re-anchors", async () => {
+    const { doc } = await freshDoc("docs/f12-opt.md", "# T\n\nReplace alpha please.\n");
+    const api = await getApi();
+    const p = api.proposalController;
+    const fp = { text: "Replace alpha please.", before: "", after: "", lineHint: 2 };
+    const id = await p.propose(doc, fp, "Replace ALPHA please.",
+      { kind: "agent", id: "claude", agent: { sdk: "x", model: "m", sessionId: "s" } }, { granularity: "block" });
+    await api.proposalController.optimisticApply(doc, id!);
+    await settle();
+    assert.ok(doc.getText().includes("Replace ALPHA please."), "applied to buffer");
+    // re-anchored: the proposal still resolves against the mutated buffer
+    assert.strictEqual(p.listProposals(doc)[0].anchorStart !== null, true, "re-anchored, resolves");
+    assert.strictEqual(p.listProposals(doc)[0].original, "Replace alpha please.", "original stored");
+  });
+
+  test("finalizeInPlace clears the proposal and keeps the applied text (no double-apply)", async () => {
+    const { doc } = await freshDoc("docs/f12-fin.md", "# T\n\nKeep alpha now.\n");
+    const api = await getApi();
+    const p = api.proposalController;
+    const docPath = p.keyFor(doc);
+    const fp = { text: "Keep alpha now.", before: "", after: "", lineHint: 2 };
+    const id = await p.propose(doc, fp, "Keep ALPHA now.",
+      { kind: "agent", id: "claude", agent: { sdk: "x", model: "m", sessionId: "s" } }, { granularity: "block" });
+    await p.optimisticApply(doc, id!);
+    await settle();
+    const ok = await p.finalizeInPlace(docPath, id!);
+    await settle();
+    assert.ok(ok, "finalized");
+    assert.strictEqual(doc.getText(), "# T\n\nKeep ALPHA now.\n", "applied text retained, no double-apply");
+    assert.strictEqual(p.listProposals(doc).length, 0, "proposal cleared");
+  });
+
+  test("revertInPlace restores the original and clears the proposal", async () => {
+    const { doc } = await freshDoc("docs/f12-rev.md", "# T\n\nUndo alpha here.\n");
+    const api = await getApi();
+    const p = api.proposalController;
+    const docPath = p.keyFor(doc);
+    const fp = { text: "Undo alpha here.", before: "", after: "", lineHint: 2 };
+    const id = await p.propose(doc, fp, "Undo ALPHA here.",
+      { kind: "agent", id: "claude", agent: { sdk: "x", model: "m", sessionId: "s" } }, { granularity: "block" });
+    await p.optimisticApply(doc, id!);
+    await settle();
+    const ok = await p.revertInPlace(docPath, id!);
+    await settle();
+    assert.ok(ok, "reverted");
+    assert.strictEqual(doc.getText(), "# T\n\nUndo alpha here.\n", "original restored");
+    assert.strictEqual(p.listProposals(doc).length, 0, "proposal cleared");
+  });
+
+  test("rejectAll reverts every pending proposal", async () => {
+    const { doc } = await freshDoc("docs/f12-rejall.md", "# T\n\nOne aaa.\n\nTwo bbb.\n");
+    const api = await getApi();
+    const ctl = api.trackChangesPreviewController;
+    const p = api.proposalController;
+    ctl.setEditTurnForTest(async () => ({ replacement: "# T\n\nOne AAA.\n\nTwo BBB.\n", model: "m", sessionId: "s" }));
+    const ids = await ctl.runEditAndPropose(doc, { kind: "document" }, "up");
+    await settle();
+    for (const id of ids) await p.optimisticApply(doc, id);
+    await settle();
+    assert.ok(doc.getText().includes("AAA") && doc.getText().includes("BBB"), "both applied");
+    const { reverted } = await p.rejectAll(doc);
+    await settle();
+    assert.strictEqual(reverted, ids.length, "all reverted");
+    assert.strictEqual(doc.getText(), "# T\n\nOne aaa.\n\nTwo bbb.\n", "document restored");
+    assert.strictEqual(p.listProposals(doc).length, 0, "all cleared");
+  });
+});
+
+suite("F12 inline diff — INV-50 listProposals.replaced", () => {
+  test("listProposals reports the original as `replaced` after optimistic apply", async () => {
+    const { doc } = await freshDoc("docs/f12-replaced.md", "# R\n\nbrown here.\n");
+    const api = await getApi();
+    const ctl = api.trackChangesPreviewController;
+    ctl.setEditTurnForTest(async () => ({ replacement: "# R\n\nred here.\n", model: "m", sessionId: "s" }));
+    await ctl.runEditAndPropose(doc, { kind: "document" }, "x");
+    await settle(); await settle();
+    assert.strictEqual(api.proposalController.listProposals(doc)[0].replaced, "brown here.");
+  });
+});
+
+suite("F12 inline diff — editor surface (#64, INV-48/52)", () => {
+  test("proposing optimistically applies into the editor and the buffer is the accepted result", async () => {
+    const { doc } = await freshDoc("docs/f12-editor.md", "# E\n\nThe brown fox runs.\n");
+    const api = await getApi();
+    const ctl = api.trackChangesPreviewController;
+    ctl.setEditTurnForTest(async () => ({ replacement: "# E\n\nThe red fox runs.\n", model: "m", sessionId: "s" }));
+    await ctl.runEditAndPropose(doc, { kind: "document" }, "recolor the fox");
+    await settle(); await settle();
+    assert.ok(doc.getText().includes("The red fox runs."), "optimistically applied into the buffer");
+    const v = api.proposalController.listProposals(doc)[0];
+    assert.strictEqual(v.original, "The brown fox runs.", "original captured for the deletion hint/revert");
+  });
+
+  test("editing the inserted text then finalizing keeps the human edit", async () => {
+    const { doc } = await freshDoc("docs/f12-edit-keep.md", "# E\n\nalpha word here.\n");
+    const api = await getApi();
+    const ctl = api.trackChangesPreviewController;
+    ctl.setEditTurnForTest(async () => ({ replacement: "# E\n\nALPHA word here.\n", model: "m", sessionId: "s" }));
+    const ids = await ctl.runEditAndPropose(doc, { kind: "document" }, "up");
+    await settle(); await settle();
+    // human tweaks the inserted text
+    const at = doc.getText().indexOf("ALPHA");
+    const we = new vscode.WorkspaceEdit();
+    we.replace(doc.uri, new vscode.Range(doc.positionAt(at), doc.positionAt(at + 5)), "ALPHA!");
+    await vscode.workspace.applyEdit(we);
+    await settle();
+    // keyFor(doc) gives the repo-relative path that finalizeInPlace uses as its key;
+    // the `key` from freshDoc is the URI string, which would not match for in-workspace docs.
+    const docKey = api.proposalController.keyFor(doc);
+    await api.proposalController.finalizeInPlace(docKey, ids[0]);
+    await settle();
+    assert.ok(doc.getText().includes("ALPHA! word here."), "human edit preserved on accept");
+    assert.strictEqual(api.proposalController.listProposals(doc).length, 0, "cleared");
+  });
+});
+
+suite("F12 inline diff — control parity (#64, INV-53)", () => {
+  test("reject from the webview reverts in place; rejectAll clears every proposal", async () => {
+    const { doc, key } = await freshDoc("docs/f12-parity.md", "# P\n\nuno aaa.\n\ndos bbb.\n");
+    const api = await getApi();
+    const ctl = api.trackChangesPreviewController;
+    await vscode.commands.executeCommand("cowriting.showTrackChangesPreview");
+    await settle();
+    ctl.setEditTurnForTest(async () => ({ replacement: "# P\n\nuno AAA.\n\ndos BBB.\n", model: "m", sessionId: "s" }));
+    const ids = await ctl.runEditAndPropose(doc, { kind: "document" }, "up");
+    await settle(); await settle();
+    assert.ok(doc.getText().includes("AAA") && doc.getText().includes("BBB"));
+    // reject ONE via the webview intent → that block reverts, the other stays applied
+    ctl.receiveMessage(key, { type: "reject", proposalId: ids[0] });
+    await settle(); await settle();
+    assert.ok(doc.getText().includes("uno aaa.") && doc.getText().includes("BBB"), "one reverted, one applied");
+    // rejectAll via the command → all gone, document restored
+    ctl.receiveMessage(key, { type: "rejectAll" });
+    await settle(); await settle();
+    assert.strictEqual(doc.getText(), "# P\n\nuno aaa.\n\ndos bbb.\n", "document restored");
+    assert.strictEqual(api.proposalController.listProposals(doc).length, 0);
+  });
+
+  test("cowriting.rejectAllProposals is registered + markdown-guarded", async () => {
+    const all = await vscode.commands.getCommands(true);
+    assert.ok(all.includes("cowriting.rejectAllProposals"));
+    const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, "../../../../package.json"), "utf8"));
+    const entry = (pkg.contributes.menus.commandPalette as Array<{ command: string; when?: string }>).find(
+      (m) => m.command === "cowriting.rejectAllProposals",
+    );
+    assert.ok(entry && /editorLangId == markdown/.test(entry.when ?? ""), "palette-guarded on markdown");
+  });
+});
+
+// Reload-safety: a proposal that was optimistically applied in a PRIOR session
+// persists with `original` set and its fp re-anchored to the applied text. A fresh
+// controller (empty in-memory `applied` set) must NOT re-capture `original` from the
+// already-applied buffer — doing so would clobber the true revert target and break
+// Reject. (Regression for the final-review CRITICAL; INV-51/54.)
+suite("F12 inline diff — reload-safety (#64, INV-51/54)", () => {
+  test("optimisticApply does not clobber a previously-persisted original", async () => {
+    const TRUE_ORIGINAL = "The original sentence here.";
+    const APPLIED = "The APPLIED sentence here.";
+    const { doc } = await freshDoc("docs/f12-reload.md", `# R\n\n${TRUE_ORIGINAL}\n`);
+    const api = await getApi();
+    const p = api.proposalController;
+    const key = p.keyFor(doc);
+
+    // 1) The buffer holds the APPLIED text (as the saved-while-pending file would).
+    const at = doc.getText().indexOf(TRUE_ORIGINAL);
+    const we = new vscode.WorkspaceEdit();
+    we.replace(doc.uri, new vscode.Range(doc.positionAt(at), doc.positionAt(at + TRUE_ORIGINAL.length)), APPLIED);
+    assert.ok(await vscode.workspace.applyEdit(we), "apply the prior-session applied text");
+    await settle();
+
+    // 2) Record the proposal directly in the sidecar exactly as a prior session left
+    //    it: fp anchored to the APPLIED text + `original` = the TRUE original. We do
+    //    NOT call optimisticApply, so this controller's in-memory `applied` stays empty.
+    const appliedAt = doc.getText().indexOf(APPLIED);
+    const appliedFp = buildFingerprint(doc.getText(), { start: appliedAt, end: appliedAt + APPLIED.length });
+    let id = "";
+    api.sidecarRouter.update(key, (a) => {
+      id = addProposal(a, appliedFp, APPLIED, { kind: "agent", id: "claude", agent: { sdk: "x", model: "m", sessionId: "s" } }, { granularity: "block" }).proposalId;
+      setProposalApplied(a, id, appliedFp, TRUE_ORIGINAL);
+    });
+    p.renderAll(doc);
+    await settle();
+
+    // 3) Re-entry as a reload would trigger (EditorProposalController re-applies on
+    //    onDidChangeProposals because `applied` is empty). The guard must preserve original.
+    await p.optimisticApply(doc, id);
+    await settle();
+    const view = p.listProposals(doc).find((v) => v.id === id);
+    assert.ok(view, "proposal still present");
+    assert.strictEqual(view!.original, TRUE_ORIGINAL, "true original preserved, NOT clobbered with the applied text");
+
+    // 4) Reject restores the TRUE original (not the applied text).
+    assert.ok(await p.revertInPlace(key, id), "revert");
+    await settle();
+    assert.ok(doc.getText().includes(TRUE_ORIGINAL), "reject restored the true original");
+    assert.ok(!doc.getText().includes(APPLIED), "applied text removed on reject");
+  });
+});

test/e2e/suite/f12Reach.test.ts

@@ -98,8 +98,10 @@ suite("F12 SLICE-1 — Ask-Claude reach (#42, INV-38)", () => {
       0,
       "active doc A was NOT edited — editDocument honored the tab URI",
     );
-    // INV-10: proposing never mutates the document.
-    assert.ok(b.doc.getText().includes("tab target paragraph"), "tab doc unchanged by propose");
+    // F12 (INV-48): EditorProposalController optimistically applies proposals into the
+    // buffer, so the proposed text is now in the tab doc B. Confirm one of the proposal
+    // texts is present (the tab doc was edited, not A).
+    assert.ok(b.doc.getText().includes("REWRITTEN"), "F12 optimistic-apply: proposed text in tab doc B");
   });
 
   // No URI arg (palette / keybinding) → fall back to the active editor.

test/e2e/suite/liveProgress.test.ts

@@ -50,7 +50,10 @@ suite("#60 live turn progress (additive + cancel)", () => {
     assert.strictEqual(ids.length, 1, "one changed block → one proposal, regardless of progress events");
     const view = api.proposalController.listProposals(doc).find((v) => v.id === ids[0]);
     assert.ok(view, "the proposal is live");
-    assert.ok(doc.getText().includes("Old paragraph."), "document unchanged by propose (INV-10)");
+    // F12 (INV-48): the EditorProposalController optimistically applies the proposed
+    // text into the buffer, so after settle the active-editor buffer shows the
+    // replacement. The proposal is still pending (not finalized) until Accept.
+    assert.ok(doc.getText().includes("New paragraph."), "F12 optimistic-apply: proposed text in buffer");
   });
 
   test("an aborted turn proposes nothing (INV-47)", async () => {

test/e2e/suite/proposals.test.ts

@@ -63,13 +63,14 @@ suite("F4 propose/accept (host E2E — programmatic ingress, no LLM)", () => {
   const TARGET = "The propose target sentence lives here.";
   const REPLACEMENT = "PROPOSED-BY-CLAUDE replacement sentence.";
 
-  test("propose records + renders a pending proposal and does NOT touch the document (INV-10)", async () => {
+  test("propose records a pending proposal; F12 optimistically applies it (INV-48, reverses INV-10)", async () => {
     const doc = await openDoc();
     const api = await getApi();
-    const before = doc.getText();
     await proposeViaCommand(doc, TARGET, REPLACEMENT, "turn-p1");
     await settle();
-    assert.strictEqual(doc.getText(), before, "document text unchanged (INV-10)");
+    // F12 (INV-48): EditorProposalController auto-applies the proposed text into the
+    // buffer, so after settle the buffer has the replacement text (INV-10 is reversed).
+    assert.ok(doc.getText().includes(REPLACEMENT), "F12 optimistic-apply: replacement in buffer after propose");
     const rendered = api.proposalController.getRendered(DOC_REL);
     assert.strictEqual(rendered.length, 1);
     assert.strictEqual(rendered[0].pending, true);
@@ -77,7 +78,8 @@ suite("F4 propose/accept (host E2E — programmatic ingress, no LLM)", () => {
     assert.strictEqual(rendered[0].canReply, false, "proposals are decide-only — no dead reply input (INV-12)");
     const art = readSidecar();
     assert.strictEqual(art.proposals.length, 1, "proposal persisted at propose time");
-    assert.strictEqual(art.anchors[art.proposals[0].anchorId].fingerprint.text, TARGET);
+    // After optimistic apply, the fingerprint re-anchors to the replacement text.
+    assert.strictEqual(art.anchors[art.proposals[0].anchorId].fingerprint.text, REPLACEMENT);
   });
 
   test("accept applies via the seam: text replaced, Claude-attributed, proposal removed (INV-9/11/13)", async () => {
@@ -97,15 +99,18 @@ suite("F4 propose/accept (host E2E — programmatic ingress, no LLM)", () => {
     assert.strictEqual(readSidecar().proposals.length, 0, "removed from the sidecar");
   });
 
-  test("reject leaves the document untouched and removes the proposal (PUC-3)", async () => {
+  test("reject reverts the optimistically-applied text and removes the proposal (PUC-3, F12-INV-48)", async () => {
     const doc = await openDoc();
     const api = await getApi();
     const before = doc.getText();
     const id = await proposeViaCommand(doc, "A second target for coexistence checks.", "WOULD-BE replacement.", "turn-p2");
     await settle();
-    assert.strictEqual(api.proposalController.rejectById(DOC_REL, id), true);
+    // F12: optimistic apply has put "WOULD-BE replacement." in the buffer.
+    assert.ok(doc.getText().includes("WOULD-BE replacement."), "F12: optimistically applied");
+    // rejectByIdInPlace reverts the buffer to the original (PUC-3, INV-51).
+    assert.ok(await api.proposalController.rejectByIdInPlace(DOC_REL, id), "rejectByIdInPlace removes + reverts");
     await settle();
-    assert.strictEqual(doc.getText(), before, "document untouched");
+    assert.strictEqual(doc.getText(), before, "document restored to pre-propose state");
     assert.strictEqual(api.proposalController.getRendered(DOC_REL).length, 0);
     assert.strictEqual(readSidecar().proposals.length, 0);
   });
@@ -114,25 +119,35 @@ suite("F4 propose/accept (host E2E — programmatic ingress, no LLM)", () => {
     let doc = await openDoc();
     const api = await getApi();
     const anchor = "A stable closing paragraph.";
-    await proposeViaCommand(doc, anchor, "A PROPOSED closing paragraph.", "turn-p3");
+    const appliedText = "A PROPOSED closing paragraph.";
+    await proposeViaCommand(doc, anchor, appliedText, "turn-p3");
     await settle();
+    // F12: optimistic apply has put the proposed text in the buffer (anchor → appliedText).
+    assert.ok(doc.getText().includes(appliedText), "F12: optimistically applied before reload");
     const uri = vscode.Uri.file(path.join(WS, DOC_REL));
+    // doc.getText() now has appliedText; the reload prepends a line.
     doc = await externalWriteAndReload(uri, "PREPENDED LINE\n\n" + doc.getText());
     await settle();
     api.proposalController.renderAll(doc);
     const rendered = api.proposalController.getRendered(DOC_REL);
     assert.strictEqual(rendered.length, 1, "proposal survived reload");
     assert.strictEqual(rendered[0].pending, true, "still decidable");
-    const moved = doc.getText().indexOf(anchor);
-    assert.strictEqual(rendered[0].range.start, moved, "re-anchored after the move");
+    // After F12 re-anchor, the fingerprint tracks the appliedText, not the original anchor.
+    const moved = doc.getText().indexOf(appliedText);
+    assert.ok(moved >= 0, "applied text present in the reloaded document");
+    assert.strictEqual(rendered[0].range.start, moved, "re-anchored to appliedText after the move");
   });
 
   test("editing the target text makes the proposal stale: flagged, accept refused, doc untouched (INV-11)", async () => {
     let doc = await openDoc();
     const api = await getApi();
     const id = api.proposalController.getRendered(DOC_REL)[0].id;
-    const mangled = doc.getText().replace("A stable closing paragraph.", "A reworded closing paragraph.");
-    doc = await externalWriteAndReload(vscode.Uri.file(path.join(WS, DOC_REL)), mangled);
+    // After F12 optimistic apply the fingerprint tracks the APPLIED text ("A PROPOSED
+    // closing paragraph."), not the original.  Mangle that text to make the proposal stale.
+    const preMangled = doc.getText();
+    const mangled = preMangled.replace("A PROPOSED closing paragraph.", "A reworded closing paragraph.");
+    const uri = vscode.Uri.file(path.join(WS, DOC_REL));
+    doc = await externalWriteAndReload(uri, mangled);
     await settle();
     api.proposalController.renderAll(doc);
     assert.strictEqual(api.proposalController.getStaleCount(DOC_REL), 1, "flagged stale");
@@ -143,22 +158,30 @@ suite("F4 propose/accept (host E2E — programmatic ingress, no LLM)", () => {
     assert.strictEqual(readSidecar().proposals.length, 1, "proposal still pending (recoverable)");
     // discard the husk so later tests see a clean sidecar
     assert.strictEqual(api.proposalController.rejectById(DOC_REL, id), true);
+    // Restore the file so subsequent tests can find their fixture targets:
+    // replace the optimistically-applied text back to the original fixture text.
+    const restored = preMangled.replace("A PROPOSED closing paragraph.", "A stable closing paragraph.");
+    doc = await externalWriteAndReload(uri, restored);
+    await settle();
   });
 
   test("multiple pending proposals coexist and are decidable out of order (PUC-5)", async () => {
     const doc = await openDoc();
     const api = await getApi();
-    const id1 = await proposeViaCommand(doc, "A stable opening paragraph.", "An ACCEPTED opening paragraph.", "turn-p4");
-    const id2 = await proposeViaCommand(doc, "PROPOSED-BY-CLAUDE replacement sentence.", "A REPLACED-AGAIN sentence.", "turn-p5");
+    // Clean up any proposals left over from prior tests (F12: proposals persist in state).
+    await api.proposalController.rejectAll(doc);
     await settle();
-    assert.strictEqual(api.proposalController.getRendered(DOC_REL).length, 2);
+    const id1 = await proposeViaCommand(doc, "A stable opening paragraph.", "An ACCEPTED opening paragraph.", "turn-p4");
+    const id2 = await proposeViaCommand(doc, "A stable closing paragraph.", "A REPLACED closing paragraph.", "turn-p5");
+    await settle();
+    assert.strictEqual(api.proposalController.getRendered(DOC_REL).length, 2, "two new proposals");
     // decide the SECOND first, then the first — order independence
     assert.strictEqual(await api.proposalController.acceptById(DOC_REL, id2), true);
     await settle();
     assert.strictEqual(await api.proposalController.acceptById(DOC_REL, id1), true);
     await settle();
     assert.ok(doc.getText().includes("An ACCEPTED opening paragraph."));
-    assert.ok(doc.getText().includes("A REPLACED-AGAIN sentence."));
+    assert.ok(doc.getText().includes("A REPLACED closing paragraph."));
     assert.strictEqual(api.proposalController.getRendered(DOC_REL).length, 0);
   });
 });

test/proposalModel.test.ts

@@ -9,7 +9,7 @@ import {
   type Proposal,
 } from "../src/model";
 import { CoauthorStore } from "../src/store";
-import { addProposal, proposalBody, removeProposal } from "../src/proposalModel";
+import { addProposal, proposalBody, removeProposal, setProposalApplied } from "../src/proposalModel";
 
 const agent = {
   kind: "agent" as const,
@@ -104,4 +104,19 @@ describe("proposalModel helpers (spec §6.4)", () => {
     expect(body).toContain("- old line two");
     expect(body).toContain("+ new only line");
   });
+
+  it("setProposalApplied stores original and re-anchors the fingerprint to the applied text", () => {
+    const a = emptyArtifact("docs/x.md");
+    const { proposalId, anchorId } = addProposal(
+      a,
+      { text: "old", before: "", after: "", lineHint: 0 },
+      "new",
+      { kind: "agent", id: "claude", agent: { sdk: "x", model: "m", sessionId: "s" } },
+      { granularity: "block" },
+    );
+    setProposalApplied(a, proposalId, { text: "new", before: "", after: "", lineHint: 0 }, "old");
+    const p = a.proposals.find((x) => x.id === proposalId)!;
+    expect(p.original).toBe("old");
+    expect(a.anchors[anchorId].fingerprint.text).toBe("new");
+  });
 });

test/trackChangesModel.test.ts

@@ -231,7 +231,7 @@ describe("renderReview", () => {
     const html = renderReview("hello world", "hello", [], []);
     expect(html).toMatch(/<del>|cw-del/);
   });
-  test("renderReview: a pending proposal renders a blue block with data-proposal-id and ✓/✗ actions", () => {
+  test("renderReview: a pending proposal renders a blue block with data-proposal-id and Accept/Reject actions", () => {
     const proposals: ProposalView[] = [{ id: "p1", anchorStart: 0, anchorEnd: 5, replaced: "hello", replacement: "goodbye" }];
     const html = renderReview("hello", "hello", [], proposals);
     expect(html).toContain('class="cw-proposal"');
@@ -375,6 +375,55 @@ describe("renderReview", () => {
     const b = renderReview(doc, doc, [], proposals);
     expect(a).toBe(b);
   });
+
+  test("renderReview renders an applied proposal ONCE, not also as a landed diff (INV-50)", () => {
+    const baseline = "# T\n\nThe brown fox.\n";
+    const current = "# T\n\nThe red fox.\n"; // proposal already optimistically applied
+    const proposals: ProposalView[] = [{
+      id: "pr_1",
+      anchorStart: current.indexOf("The red fox."),
+      anchorEnd: current.indexOf("The red fox.") + "The red fox.".length,
+      replaced: "The brown fox.",      // original
+      replacement: "The red fox.",
+    }];
+    const html = renderReview(baseline, current, [], proposals);
+    // exactly one proposal block
+    expect((html.match(/cw-proposal/g) ?? []).length).toBe(1);
+    // the applied paragraph is NOT also emitted as a word-merged changed block
+    expect(html).not.toContain("<del>brown</del>"); // no double-render of the change as a baseline diff
+  });
+
+  test("renderReview keeps author coloring aligned on a block AFTER a length-changing pending proposal (INV-49/50)", () => {
+    // block 1 has a pending proposal whose applied text is MUCH LONGER than its
+    // original; block 2 carries a Claude authorship span (in currentText coords).
+    const baseline = "one short.\n\ntwo stable here.\n";
+    const current = "one MUCH LONGER REPLACED TEXT.\n\ntwo stable here.\n";
+    const proposals: ProposalView[] = [{
+      id: "pr_1",
+      anchorStart: current.indexOf("one MUCH LONGER REPLACED TEXT."),
+      anchorEnd: current.indexOf("one MUCH LONGER REPLACED TEXT.") + "one MUCH LONGER REPLACED TEXT.".length,
+      replaced: "one short.",
+      replacement: "one MUCH LONGER REPLACED TEXT.",
+      original: "one short.",
+    }];
+    const sStart = current.indexOf("stable");
+    const authorSpans = [{ start: sStart, end: sStart + "stable".length, author: "claude" as const }];
+    const html = renderReview(baseline, current, authorSpans, proposals);
+    // the Claude coloring wraps "stable" exactly — not shifted by the proposal's length delta.
+    expect(html).toMatch(/<span class="cw-by-claude">stable<\/span>/);
+  });
+
+  test("proposalBlockHtml renders Accept/Reject controls with dropdown carets (#64)", () => {
+    const html = renderReview("a\n", "b\n", [], [
+      { id: "pr_1", anchorStart: 0, anchorEnd: 1, replaced: "a", replacement: "b" },
+    ]);
+    expect(html).toMatch(/data-action="accept"/);
+    expect(html).toMatch(/data-action="reject"/);
+    expect(html).toMatch(/data-action="acceptAll"/);
+    expect(html).toMatch(/data-action="rejectAll"/);
+    expect(html).toMatch(/Accept/);
+    expect(html).toMatch(/Reject/);
+  });
 });
 
 import { renderTrackChanges as rtc2 } from "../src/trackChangesModel";