fix(launcher): harden updater crash recovery

docs/superpowers/specs/2026-08-14-launcher-campaign-design.md

@@ -298,19 +298,19 @@ preview would be a deliberate divergence we are NOT taking.
   install to `DataDirectory/app/<version>/`; atomic pointer swap
   (`current.json`); never while any session is running; keep the previous
   version for one-step rollback.
-- **Launcher self-update:** same feed; staged download; rename-dance swap
-  on next start (a running exe can't replace itself on Windows).
+- **Launcher self-update:** same feed; staged download; target-local atomic
+  replacement on next start after the running process exits.
 - **Feed hosting:** GitHub Releases (user-confirmed). Manifest and zips
   are release assets; the launcher pins the repo/owner in its config.
 
 The exact v1 manifest, extracted-version record, `current.json` activation
-pointer, shared-session/exclusive-update OS lease, and durable self-update
-plan are pinned in
+pointer and launcher ownership record, shared-session/exclusive-update OS
+lease, and durable self-update plan schema 2 are pinned in
 `docs/plans/2026-08-14-launcher-campaign.md` under **Pinned updater
 contracts (v1, BINDING)**. That section is normative: implementations reject
 unknown/duplicate fields and unsupported versions, use strict SemVer 2.0
 precedence, verify bounded streamed downloads before safe ZIP extraction, and
-derive all mutable staging/backup paths from the application data root. The
+use per-hop redirect validation plus same-filesystem atomic replacement. The
 LA9 DAT/pak install record remains the sole content descriptor fed to session
 configs; LA10 changes only which verified `app/current.json` client binaries
 the process supervisor executes.