[mtskf]

Summary

Four outcomes that used to be silent now tell the user what happened, each by reusing an existing toast or the existing notice slot. No recovery store, no new reducer effect, no protocol change.

Changes

• Rejected draft lost on tab close — a draft the write-gate refused never reaches the TextDocument, so VS Code shows no save prompt and revert-rescue (which compares TextDocument bytes) cannot see it. On dispose the panel now reads a rejection that is still pending when the tab closes and reopens the draft as an untitled Markdown document, with one warning toast; the rescue runs before the rest of the teardown, so an unrelated teardown failure cannot take the draft with it. The guarantee covers an ordinary tab close; a window close or reload is best effort, because nothing awaits onDidDispose. Not covered: an edit stashed behind an in-flight save and refused only when it drains after the tab has closed keeps its existing Cannot save toast and is not reopened (tracked as a follow-up).
• Rejected draft replaced by an external write — the discard notice from fix(webview): announce a rejected draft that an external write replaces #458 gains a "Copy draft" button. The pre-replace text is held in one slot (latest wins, emptied by dismiss) and read at click time; a last-attempt-wins counter keeps a late clipboard result from mislabelling a newer draft.
• Stash dropped after dispose — a post-dispose settlement that drops the stashed edit on an observed mismatch or a divergence now shows one toast, worded without assuming an external write. It stays silent when the observed document already carries the stash's text. The alive path is unchanged.
• Format Document — runFormatDocument returns formatted | unchanged | readonly | too-large | failed instead of a boolean, and the shell says which. "No changes were needed" is no longer indistinguishable from a failure, and the failure text does not claim nothing changed (a dispatch that throws is not guaranteed to roll back). These notices rank below every loss notice and are cleared by a successful format.

Test-only plumbing: the E2E harness gains openRescuedDraftOverride (same pattern as the existing overrides) and installs a no-op by default, so suites that are not about the rescue never inherit a dirty untitled document. Only the rescue's own suite exercises the real open.

Not included

A general recovery store, persistence, keeping a rejected draft on screen behind an unresolved-state gate, and an untitled export for the post-dispose stash drop (notification only).

Related TODO

ARCH-05 (05a-1, 05a-2, 05a-3, 05d).

Test plan

Each slice's tests were observed red against the unchanged source first.

• pnpm compile
• pnpm lint
• pnpm vitest run — 294 files, 5883 tests
• pnpm test:browser — 82 tests
• pnpm test:e2e — 117 passing, twice in a row
• pnpm check:doc-sync
• pnpm package — vsix audit clean
• Manual: close a Quoll tab while a "Cannot save" banner is showing and confirm the draft opens as an untitled document