Pre-release hardening found during a code audit. Four data-integrity fixes; no user-facing behavior changes beyond closing these gaps.

1. Folder rename/move lost child records and manual order (data loss)

Obsidian fires a single rename event for the folder itself when a folder is renamed or moved — not one per child file. The old handler only updated tree-expansion/selection state, so:

• The file index kept stale child records (keyed by old paths).
• manualOrder entries under the old path became stale and were pruned on the next manual-mode render, silently discarding the user's sort for the whole moved folder.

Fix: FileIndex.renameFolder() rewrites every record at or under the old path (path + parentPath); matching manualOrder entries are rewritten via the existing renameNestedPath helper. Added 4 tests (nested files, count preservation, no-op, shared-name-prefix guard).

2. Pending manual-order save dropped on close

scheduleSaveOrder debounces the save by 500ms, but onClose only cleared the timer — it never flushed. Reordering then closing the leaf within 500ms lost the change on next load.

Fix: onClose flushes the pending save synchronously before the view is torn down.

3. Inconsistent new-file placement in manual order

The create handler appended new files to manualOrder inline, which contradicted initializeManualOrder's reconcile (which places missing files at their seed-sorted position). The resulting order depended on whether files were created before or after the last manual session.

Fix: removed the inline append; reconcile now owns new-file placement consistently with its design.

4. Names with path separators / .. created files at unintended locations

Inline create/rename only stripped leading/trailing slashes, so a name like a/b/c or foo/../bar silently created deeply nested paths or escaped the target folder.

Fix: reject names containing /, \, or .. with a Notice.

Verification

• npm run build ✅
• npm run lint ✅
• npm test — 116 tests / 18 suites ✅ (added 4 FileIndex.renameFolder tests)

Known follow-ups (not in this PR, low frequency)

• Mid-drag vault events can interrupt an active manual drag (DragSortManager teardown).
• DragSortManager attaches anonymous row listeners without matching removal (relied on by DOM teardown).

These are pre-existing and rare; safe to address separately.