docs: mark D6 Windows rich-toast AUMID fixed + add runtime test

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

LOTUS_TODO.md

@@ -88,7 +88,7 @@ Tier-2 bug-hunt (desktop/native, crypto/session/infra, messaging data) by 3 para
 
 **Still open (low tail / follow-ups):**
 
-- **D4** cold-start deep link may navigate twice (idempotent; guard the argv path). **D6** WinRT rich-toast AUMID never registered → P5-41 quick-reply / P5-35 click-to-open are inert on Windows (falls back to plain toast) — a wiring task. **D7** Unity badge `application://cinny.desktop` id may not match the installed `.desktop` basename (runtime-verify on the `.deb`/AppImage).
+- **D4** cold-start deep link may navigate twice (idempotent; guard the argv path). **D6 ✅ FIXED (2026-07):** WinRT rich-toast AUMID now registered (`native/aumid.rs`: SetCurrentProcessExplicitAppUserModelID + a Start-Menu shortcut with PKEY_AppUserModel_ID; toast uses CreateToastNotifierWithId) so P5-41 quick-reply / P5-35 click-to-open work on Windows. **CI-compile-pending; runtime-verify on a Windows build.** **D7** Unity badge `application://cinny.desktop` id may not match the installed `.desktop` basename (runtime-verify on the `.deb`/AppImage).
 - **F3** session blob unconditionally wins over legacy keys even if legacy is fresher (downgrade-then-upgrade → stale token → forced re-login); **F5** OIDC refresh drops `expiresAt`/id-token claims on persist; **F6** server-forced logout leaves a stale token in the SW + skips issuer revocation (token already revoked server-side — minor).
 - **Nit:** ForwardMessageDialog doesn't strip `m.mentions` → forwarding can re-ping.