docs: mark D6 Windows rich-toast AUMID fixed + add runtime test

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

LOTUS_TESTING.md

@@ -675,6 +675,8 @@ Run the axe DevTools extension (or Lighthouse → Accessibility) on a room view,
 
 ## Outstanding verification backlog
 
+**Windows rich toast (D6, 2026-07 — desktop/Windows build only):** get a message notification while the desktop app is backgrounded → the toast is attributed to **Lotus Chat** (not "PowerShell"/generic) and shows an inline **reply box + Send**; typing a reply + Send **posts it to that room**; clicking the toast body **opens the room**. Previously these silently fell back to a plain toast (no reply/click). If it still falls back, check that a `Lotus Chat.lnk` exists in the Start-Menu Programs folder.
+
 **Invite QR is now generated LOCALLY (2026-07):** Room settings → Share Room → the QR code renders (a black-on-white SVG in a white box) with **no network request** to `api.qrserver.com` (check DevTools Network — there should be no external QR fetch, and it should work offline / behind strict CSP). **Scan it** with a phone camera / Matrix app → it opens the correct `matrix.to` room-invite link. (`api.qrserver.com` was removed from the prod CSP img-src, so a regression would make the QR blank rather than silently phone home.)
 
 **Unread dot on federated rooms + avatar-decoration console storm (2026-07):**

LOTUS_TODO.md

@@ -88,7 +88,7 @@ Tier-2 bug-hunt (desktop/native, crypto/session/infra, messaging data) by 3 para
 
 **Still open (low tail / follow-ups):**
 
-- **D4** cold-start deep link may navigate twice (idempotent; guard the argv path). **D6** WinRT rich-toast AUMID never registered → P5-41 quick-reply / P5-35 click-to-open are inert on Windows (falls back to plain toast) — a wiring task. **D7** Unity badge `application://cinny.desktop` id may not match the installed `.desktop` basename (runtime-verify on the `.deb`/AppImage).
+- **D4** cold-start deep link may navigate twice (idempotent; guard the argv path). **D6 ✅ FIXED (2026-07):** WinRT rich-toast AUMID now registered (`native/aumid.rs`: SetCurrentProcessExplicitAppUserModelID + a Start-Menu shortcut with PKEY_AppUserModel_ID; toast uses CreateToastNotifierWithId) so P5-41 quick-reply / P5-35 click-to-open work on Windows. **CI-compile-pending; runtime-verify on a Windows build.** **D7** Unity badge `application://cinny.desktop` id may not match the installed `.desktop` basename (runtime-verify on the `.deb`/AppImage).
 - **F3** session blob unconditionally wins over legacy keys even if legacy is fresher (downgrade-then-upgrade → stale token → forced re-login); **F5** OIDC refresh drops `expiresAt`/id-token claims on persist; **F6** server-forced logout leaves a stale token in the SW + skips issuer revocation (token already revoked server-side — minor).
 - **Nit:** ForwardMessageDialog doesn't strip `m.mentions` → forwarding can re-ping.