fix(launcher): guard orphan bake publication

docs/architecture/acdream-architecture.md

@@ -278,6 +278,9 @@ src/
   AcDream.Platform/          BCL-only portable path contract (Campaign LA LA0)
     ApplicationPathSet.cs    -> shared XDG/Windows config, data, cache,
                                 plugin, screenshot, and diagnostic paths
+    BakePublicationGuardPaths.cs
+                             -> shared launcher/Bake environment nonce and
+                                adjacent publication lock/token naming contract
     -> zero project/package references (guarded by
        tests/AcDream.Platform.Tests/PlatformDependencyBoundaryTests.cs);
        Runtime and App reference it directly; Headless reaches it
@@ -295,7 +298,12 @@ src/
                                 orchestration, and atomic SHA/size/tool-version
                                 install-record verification and recovery; one
                                 OS-handle lease serializes recovery/install per
-                                DataDirectory, and only exact adjacent
+                                DataDirectory; a second OS-held publication
+                                lock plus durable per-transaction nonce makes
+                                late orphan Bake children irrevocably stale
+                                before recovery, while already-authorized
+                                promotion completes before recovery; only exact
+                                adjacent
                                 `.<pak>.acdream-bake.<guid:N>.tmp` files are
                                 transaction-owned crash residue
     -> references Platform only; no Avalonia or game-host dependency