Just to add my 2 cents to above excellent summary.

Write the proactive tests either before writing the code or in parallel with coding. The proactive tests should test against the requirements **NOT** the implementation. The requirements doc is the bible for the proactive tests.

Write the reactive tests when a bug/issue/broken functionality is detected and add it to the test suite so that a repeat offence is automatically caught.

When to stop is an open-ended question. In practice, you stop when there are no more defects in the system. In reality, you stop when no more defects are found (or when the cost of testing outweighs the benefits/number of bugs found).

Mahesh