docs(gui-1b): finish the four-path census correction

The implementation and census name four live-window buffer replacement
paths, but two test/helper comments still called the set three and the
ledger still said only two paths already reset cursor, selection and
view_top. Correct all three counts: four replacement paths, three of
which already carried the other TUI replacement resets.

docs/active-work.md

@@ -405,11 +405,12 @@ inherit — recorded so the next census need not re-decide it.
 
 **A census taken by recall is not a census.** This is the second time
 in this lane a count was stated from memory and found short by review;
-the first was `reshape` call sites that no geometry path reached. Two already reset cursor, selection and
-`view_top` a line at a time; the horizontal origin was simply missing
-from the list. One `Window::forget_manual_horizontal_origin`, four call sites, four
-rows (L8b–L8e), each firing only on its own call site's removal. L8d
-sits in `daemon.rs` because that function is private there.
+the first was `reshape` call sites that no geometry path reached. Three
+of the four already reset cursor, selection and `view_top` a line at a
+time; the horizontal origin was simply missing from the list. One
+`Window::forget_manual_horizontal_origin`, four call sites, four rows
+(L8b–L8e), each firing only on its own call site's removal. L8d sits in
+`daemon.rs` because that function is private there.
 
 Two witness repairs in the same commit, both of the same shape — an
 assertion that looked strict and was not:

src/editor.rs

@@ -11069,7 +11069,7 @@ mod tests {
     /// The origin describes the document being shown. Carried into a
     /// successor it renders the new buffer scrolled sideways with
     /// nothing about that buffer to explain it. The GPU has had this
-    /// reset since it hit the symptom; the TUI's three replacement
+    /// reset since it hit the symptom; the TUI's four replacement
     /// paths had neither half.
     ///
     /// *Mutation: drop the `forget_manual_horizontal_origin()` call

src/window.rs

@@ -496,7 +496,7 @@ impl Window {
     /// until some later cursor motion repairs it by accident. The GPU
     /// learned this once already — `code_scroll_left` has its own line
     /// in that frontend's replacement reset, added after exactly this
-    /// symptom — and the TUI's three replacement paths had neither the
+    /// symptom — and the TUI's four replacement paths had neither the
     /// origin reset nor the latch clear.
     ///
     /// One helper rather than a copy per site, so a new replacement