fix: stop 5.2.11 from wiping the library index and ship 5.2.12

Keep missing PDFs in recent_files.json, restore from backup or bookmarks, and advertise FileDrop as Copy so Explorer cannot move user notes away.

Author: Learnmore-smart

.ai/OpenNotes.Tests/HomePageLibrarySourceTests.md

@@ -4,4 +4,4 @@
 
 ## Purpose
 
-Source contract that Home selection Move uses on-screen folders (`IsChoosingMoveTarget`) instead of a bottom `PlacementMode.Top` menu, and that Delete files goes through `TrySendToRecycleBin`.
+Source contract that Home selection Move uses on-screen folders (`IsChoosingMoveTarget`) instead of a bottom `PlacementMode.Top` menu, that Delete files goes through `TrySendToRecycleBin`, and that library tile drags do not start OLE `FileDrop` with `DragDropEffects.Move`.

.ai/OpenNotes.Tests/ProductInfoTests.md

@@ -1,5 +1,5 @@
 # OpenNotes.Tests/ProductInfoTests.cs
-> 2026-09-05 GREEN: the 5.2.11 visible-version contract failed against stale 5.2.10 production metadata, then passed after alignment; compatibility assertions remain unchanged.
+> 2026-09-06 GREEN: the 5.2.12 visible-version contract failed against stale 5.2.11 production metadata, then passed after alignment; compatibility assertions remain unchanged.
 > 2026-09-02 GREEN: the 5.2.9 visible-version contract failed against stale 5.2.8 production metadata, then passed 2/2 after alignment; compatibility assertions remain unchanged.
 > 2026-08-31 GREEN: the 5.2.8 visible-version contract failed against stale 5.2.7 production metadata, then passed 2/2 after alignment; compatibility assertions remain unchanged.
 > 2026-08-31 GREEN: the 5.2.7 visible-version contract failed against stale 5.2.6 production metadata, then passed 2/2 after alignment; compatibility assertions remain unchanged.

.ai/OpenNotes.Tests/RecentFilesServiceLibrarySurvivalTests.md

@@ -0,0 +1,5 @@
+# RecentFilesServiceLibrarySurvivalTests
+
+## Purpose
+
+Proves the library index keeps missing PDFs, restores from `recent_files.json.bak` / bookmark paths, and names file tiles from the path when `DisplayName` is empty.

.ai/OpenNotes.csproj.md

@@ -1,5 +1,5 @@
 # OpenNotes.csproj
-> 2026-09-05 RELEASED: package/assembly/file/informational metadata are 5.2.11/5.2.11.0; `RootNamespace=Caelum`, self-contained win-x64 settings, and all compatibility identities remain unchanged.
+> 2026-09-06 RELEASED: package/assembly/file/informational metadata are 5.2.12/5.2.12.0 for the library-index wipe hotfix; `RootNamespace=Caelum`, self-contained win-x64 settings, and all compatibility identities remain unchanged.
 > 2026-09-02 RELEASED: package/assembly/file/informational metadata are 5.2.9/5.2.9.0 in tag `v5.2.9`; `RootNamespace=Caelum`, self-contained win-x64 settings, and all compatibility identities remain unchanged.
 > 2026-08-31 GREEN: package/assembly/file/informational metadata are 5.2.8/5.2.8.0 for the eraser stylus-crash hotfix; `RootNamespace=Caelum` and all compatibility identities remain unchanged.
 > 2026-08-30 GREEN: package/assembly/file/informational metadata are 5.2.6/5.2.6.0 for the editor reliability, page reorder, editable shape, and detachable-tab release; compatibility identities remain unchanged.

.ai/PROJECT_CONTEXT.md

@@ -1,5 +1,5 @@
 # PROJECT_CONTEXT — OpenNotes（Caelum legacy compatibility）
-> Last updated: 2026-09-05（5.2.11 interaction/Fluent release ready） | Protection: STANDARD | 本文件为 File Guardian 记忆镜像的根文档，所有 Agent 在动代码前必读。
+> Last updated: 2026-09-06（5.2.12 library wipe hotfix） | Protection: STANDARD | 本文件为 File Guardian 记忆镜像的根文档，所有 Agent 在动代码前必读。
 
 ## 项目概览
 
@@ -51,7 +51,7 @@ WPF (.NET 8) PDF 笔记应用，正式产品和工作区名称为 **OpenNotes**
 5. **单窗口 Frame 标签架构**（MainWindow `List<AppTab> _tabs` + Frame.Navigate）。
 
 ## Current Work
-- 2026-09-05: OpenNotes 5.2.11 source is aligned for GitHub Release. The interaction/Fluent waves (update check, follow-the-cursor tabs, library recycle-bin/folder color, selection chrome/rotate/ruler length, Win11 chrome) stay on WPF. Visible version is 5.2.11/5.2.11.0; Caelum namespace/data, WindowsNotesApp identity, and installer AppId remain compatible. Tag `v5.2.11` is the release trigger.
+- 2026-09-06: OpenNotes 5.2.12 is a WPF hotfix for the 5.2.11 library wipe. `RecentFilesService` no longer persist-prunes missing PDFs, restores from `recent_files.json.bak` / bookmark paths, and library tile drags use FileDrop Copy. Visible version is 5.2.12/5.2.12.0; Caelum namespace/data, WindowsNotesApp identity, and installer AppId remain compatible. Tag `v5.2.12` is the release trigger.
 - 2026-09-02: OpenNotes 5.2.10 PDF Edge-compatibility and tree-wide CropBox sanitization release is ready for commit/tag publication. Hardened PdfAtomicFile with full page-tree traversal to sanitize inherited CropBoxes up to root /Pages dictionaries, added safe geometry fallbacks in PdfService, and verified existing affected PDFs restore cleanly in Microsoft Edge with all annotations intact. Release suite passes 412/412 tests with 0 failures. Caelum namespace/data, WindowsNotesApp identity, installer AppId, and repository URL remain untouched.
 - 2026-09-02: OpenNotes 5.2.9 Edge-PDF compatibility release is published from tag commit `f96373b`. GitHub Actions run `33690709203` completed successfully and produced a non-draft/non-prerelease Release. Public verification: `OpenNotes-Setup-5.2.9.exe` is 56,112,949 bytes with SHA-256 `dfbc6e34423ab425f0be39911f0a81dbc7001f630acd77309796f86f0bed2943`; `OpenNotes-Portable-win-x64-5.2.9.zip` is 80,705,653 bytes with SHA-256 `9b78b62506afd93b17e7f3125d260f807ac89bf6ca171b8aea3e5c28ea562872`. Downloaded hashes match GitHub digests. The Portable executable reports FileVersion `5.2.9.0` / ProductVersion `5.2.9+f96373b488d990026ec0ace1918b1a57369d24d0`, contains `x64/pdfium.dll`, and remained alive through an isolated eight-second startup smoke. Release-source gates remain GREEN: ProductInfo 2/2 after expected RED, Release suite 381/381, clean-archive i18n 297 catalog entries/484 calls/0 hard-coded strings, and local self-contained publish/startup smoke. Caelum namespace/data, WindowsNotesApp identity, installer AppId, and unrelated website work remain untouched.
 - 2026-09-02: Edge PDF compatibility regression is GREEN. PdfSharpCore 1.3.67 materialized a missing page `/CropBox` as `[0 0 0 0]` when `PdfPage.CropBox` was read; OpenNotes' rotated-page geometry path then persisted that zero-area box, and real Microsoft Edge 152 reproduced the blank page while Poppler remained lenient. OpenNotes now avoids the mutating getter, falls back to `/MediaBox`, and removes only zero-area CropBoxes before every PdfSharpCore save while preserving valid explicit boxes, annotation ownership, coordinate transforms, and atomic replacement. The two regressions fail against the old behavior and pass with the fix; valid-box preservation passes; annotation/page-editing coverage passes 20/20 and 18/18; the complete suite passes 381/381 with normal Windows permissions; Release build has 0 errors; and an OpenNotes ink PDF visibly renders in desktop Edge 152 with no zero CropBox serialized.

.ai/Package.appxmanifest.md

@@ -1,5 +1,5 @@
 # Package.appxmanifest
-> 2026-09-05 GREEN: package Version is 5.2.11.0; AppX name and publisher compatibility values remain preserved.
+> 2026-09-06 GREEN: package Version is 5.2.12.0; AppX name and publisher compatibility values remain preserved.
 > 2026-09-02 GREEN: package Version is 5.2.9.0; AppX name and publisher compatibility values remain preserved.
 > 2026-08-31 GREEN: package Version is 5.2.8.0; AppX name and publisher compatibility values are preserved.
 > 2026-08-30 GREEN: package version is 5.2.6.0; AppX name and publisher compatibility values are unchanged.

.ai/Pages/HomePage.md

@@ -20,6 +20,7 @@ Displays the document/folder home surface inside the MainWindow tab shell.
 - Add-tile, folder, and file hover scale effects now run through the code-behind `AnimateTileScale` helper and `ThemeService.GetAnimationDuration`; the retired fixed `0.2/0.3` second storyboards cannot bypass ReduceMotion.
 
 - **2026-09-05 library:** Dragging PDFs onto a folder tile still uses `FolderTile_Drop` + `IsDropTarget`. Selection Move enters `IsChoosingMoveTarget` and completes by clicking a folder or breadcrumb (no bottom menu). Folder right-click color swatches write `RecentFilesService.SetFolderColor`. Delete file confirms with `DialogService.ShowDangerConfirmAsync` then `RecycleBinService.TrySendToRecycleBin` before removing the library index. “Remove from library” is unchanged.
+- **2026-09-06:** Tile `DoDragDrop` allows **Copy** only when advertising `DataFormats.FileDrop`. `Move` lets Explorer/Recycle Bin relocate or delete the real PDFs.
 
 ## Constraints
 

.ai/Services/ProductInfo.md

@@ -1,5 +1,5 @@
 # Services/ProductInfo.cs
-> 2026-09-05 GREEN: visible version is 5.2.11 for the interaction/Fluent refresh; every Caelum/WindowsNotesApp identity, data root, and URL remains unchanged.
+> 2026-09-06 GREEN: visible version is 5.2.12 for the library-index wipe hotfix; every Caelum/WindowsNotesApp identity, data root, and URL remains unchanged.
 > 2026-09-02 GREEN: visible version is 5.2.9 for Edge-PDF compatibility; every Caelum/WindowsNotesApp identity, data root, and URL remains unchanged.
 > 2026-08-31 GREEN: visible version is 5.2.8 for the eraser stylus-crash hotfix; every Caelum/WindowsNotesApp identity, data root, and URL remains unchanged.
 > 2026-08-31 GREEN: visible version is 5.2.7 for the page-rotation drawing hotfix; all Caelum/WindowsNotesApp identities, storage, and compatibility URLs remain unchanged.
@@ -18,7 +18,7 @@ Single source of truth for the visible OpenNotes brand and the compatibility ide
 - `LegacyAppxIdentity`: `WindowsNotesApp`
 - `RepositoryUrl`: `https://github.com/Learnmore-smart/Windows-Notes`
 - `WebsiteUrl`: `https://learnmore-smart.github.io/Windows-Notes/`
-- `Version`: `5.2.11`
+- `Version`: `5.2.12`
 - `Description`: localized through `LocalizationService.Get("Product.Description")`
 
 ## Important Notes / NEVER Change

.ai/Services/RecentFilesService.md

@@ -14,12 +14,12 @@ Stores the OpenNotes library index and legacy text migration data under the comp
 
 ## Open Threads / Resume Context
 
-- **Status:** ready_for_next
-- The service now uses `ProductInfo.GetDataDirectory()` so isolated editor smoke can open a PDF without attempting to write the user's AppData.
-- JSON/legacy-file names and current pruning/deduplication behavior remain unchanged.
+- **Status:** complete
+- Missing PDFs stay in `recent_files.json`. Empty index restores from `.bak` then existing `bookmarks.json` PDF keys. `GetLibraryDisplayName` falls back to the file name. Save refuses to replace a non-empty file list with zero files.
 
 ## Change History
 
 | Date | Change | Author |
 |---|---|---|
+| 2026-09-06 | Keep missing library PDFs, restore empty index from bak/bookmarks, `GetLibraryDisplayName`. | Cursor |
 | 2026-08-21 | Added the mirror and routed the service through the test-only data-root seam; production remains `%LOCALAPPDATA%\Caelum`. | Codex |

.ai/installer.iss.md

@@ -1,5 +1,5 @@
 # installer.iss
-> 2026-09-05 GREEN: default installer version is 5.2.11 for the interaction/Fluent refresh; AppId, per-user semantics, and upgrade compatibility remain preserved.
+> 2026-09-06 GREEN: default installer version is 5.2.12 for the library-index wipe hotfix; AppId, per-user semantics, and upgrade compatibility remain preserved.
 > 2026-09-02 GREEN: default installer version is 5.2.9 for Edge-PDF compatibility; AppId, per-user semantics, and upgrade compatibility remain preserved.
 > 2026-08-31 GREEN: default installer version is 5.2.8; AppId, per-user semantics, and upgrade compatibility are preserved.
 > 2026-08-30 GREEN: default installer version is 5.2.6; AppId and per-user upgrade behavior are preserved.