merge: Campaign LA LA9 - verified installer review-closed

docs/architecture/acdream-architecture.md

@@ -301,6 +301,9 @@ src/
   AcDream.Platform/          BCL-only portable path contract (Campaign LA LA0)
     ApplicationPathSet.cs    -> shared XDG/Windows config, data, cache,
                                 plugin, screenshot, and diagnostic paths
+    BakePublicationGuardPaths.cs
+                             -> shared launcher/Bake environment nonce and
+                                adjacent publication lock/token naming contract
     -> zero project/package references (guarded by
        tests/AcDream.Platform.Tests/PlatformDependencyBoundaryTests.cs);
        Runtime and App reference it directly; Headless reaches it
@@ -313,12 +316,28 @@ src/
     Status/                  -> incremental host-status parsing/tailing
     Orchestration/           -> immutable UI snapshots, typed actions,
                                 capability gates, and running-session lifetime
+    Installation/            -> portable four-DAT validation, Windows retail
+                                path discovery, versioned JSONL bake-process
+                                orchestration, and atomic SHA/size/tool-version
+                                install-record verification and recovery; one
+                                OS-handle lease serializes recovery/install per
+                                DataDirectory; a second OS-held publication
+                                lock plus durable per-transaction nonce makes
+                                late orphan Bake children irrevocably stale
+                                before recovery, while already-authorized
+                                promotion completes before recovery; only exact
+                                adjacent
+                                `.<pak>.acdream-bake.<guid:N>.tmp` files are
+                                transaction-owned crash residue
     -> references Platform only; no Avalonia or game-host dependency
 
   AcDream.Launcher/          Avalonia 12 Windows/Linux desktop shell
-    ViewModels/              -> thin MVVM projection over Launcher.Core
+    ViewModels/              -> thin MVVM projection over Launcher.Core,
+                                including the first-run DAT/bake wizard
     -> references Launcher.Core only (Platform transitively); it never owns
        a second profile, process, status, or credential state graph
+    -> every per-RID publish composes the separately published self-contained
+       `acdream-bake` executable beside the launcher without a project edge
     -> Linux launcher/probe/headless flows remain portable; graphical-client
        actions are explicitly disabled until Modern Runtime Slice L resumes