fix(documents): read through the checked command everywhere, and stop the auto-save toast repeating

[PathGao]

2 / 5 of a stack. Base: #405.

1. Three call sites still used the unchecked read

#379 added read_file_content_checked, returning (content, lossy) so a buffer decoded with U+FFFD substitutions can refuse to overwrite its source. Three places kept the bare command: toggleEdit, toggleSplitView, ensureFullContent.

They were safe — but by an argument, not by construction: each re-reads a file whose tab loadMarkdown has already flagged, and setTabRawContent does not clear the flag. That is two call sites agreeing with each other, and it holds only until someone adds a fourth reader.

All three now read through _checked and set the flag from what they read. That also clears a stale flag on a file converted to UTF-8 since it was opened — the old arrangement could carry a flag forward but never retire it.

ensureFullContent is the one with a live hazard rather than a hypothetical: it replaces a >50KB preview buffer with the whole file, and a file can be valid UTF-8 for its first 50KB and not after. Its tail now brings its own verdict.

2. The auto-save toast repeated every 1.5s

When #379's guard refuses a save, saveContent returns false, and the auto-save timer treated that like any other failure — so the generic "Auto-save failed" fired on every re-arm while the user typed, even though the specific explanation appears once per tab.

Two layers: the generic toast is suppressed once the refusal has explained itself, and a refused tab stops re-arming the timer. The first attempt still runs — that is what produces the explanation. "Save As" to a different file clears hasReplacementChars, restoring eligibility with nothing to remember.

Tests

scripts/checkedReadMigration.test.ts — the ensureFullContent tests run the real session and prove the tail's own verdict reaches the tab.

vs #405
checkedReadMigration.test.ts	9 red / 0 green
the two modified existing suites	3 red / 25 green
Final	37 / 37

lossyDecodeSaveGuard.test.ts's bare-command count tightens 1 → 0.

npm run check   0 errors
npm test        442 / 442
cargo test      131 / 131

🤖 Generated with Claude Code