merge: Campaign LA LA9 - verified installer review-closed

src/AcDream.Bake/AcDream.Bake.csproj

@@ -12,6 +12,7 @@
 
   <ItemGroup>
     <InternalsVisibleTo Include="AcDream.Bake.Tests" />
+    <InternalsVisibleTo Include="AcDream.Launcher.Core.Tests.Fixtures.InstallLeaseHolder" />
   </ItemGroup>
 
   <ItemGroup>
@@ -24,6 +25,7 @@
 
   <ItemGroup>
     <ProjectReference Include="..\AcDream.Content\AcDream.Content.csproj" />
+    <ProjectReference Include="..\AcDream.Platform\AcDream.Platform.csproj" />
   </ItemGroup>
 
 </Project>

src/AcDream.Bake/BakeCommandLine.cs

@@ -0,0 +1,133 @@
+using System.Globalization;
+
+namespace AcDream.Bake;
+
+internal sealed record BakeCommandLineOptions(
+    string DatDirectory,
+    string OutputPath,
+    HashSet<uint>? IdFilter,
+    HashSet<uint>? LandblockFilter,
+    int Threads,
+    bool ProgressJson);
+
+internal static class BakeCommandLine
+{
+    internal const string Usage =
+        "usage: acdream-bake --dat-dir <path> [--out <file>] "
+        + "[--ids 0xId,0xId,...] [--landblocks 0xId,...] "
+        + "[--threads <n>] [--progress-json]\n"
+        + "       acdream-bake --help";
+
+    public static bool IsHelpRequest(IReadOnlyList<string> args)
+    {
+        ArgumentNullException.ThrowIfNull(args);
+        return args.Count == 1
+            && args[0] is "--help" or "-h";
+    }
+
+    public static bool TryParse(
+        IReadOnlyList<string> args,
+        TextWriter error,
+        out BakeCommandLineOptions? options)
+    {
+        ArgumentNullException.ThrowIfNull(args);
+        ArgumentNullException.ThrowIfNull(error);
+
+        string? datDirectory = null;
+        string? outputPath = null;
+        HashSet<uint>? idFilter = null;
+        HashSet<uint>? landblockFilter = null;
+        int threads = Environment.ProcessorCount;
+        bool progressJson = false;
+
+        for (int i = 0; i < args.Count; i++)
+        {
+            switch (args[i])
+            {
+                case "--dat-dir":
+                    datDirectory = Value(args, ref i);
+                    break;
+                case "--out":
+                    outputPath = Value(args, ref i);
+                    break;
+                case "--ids":
+                    idFilter = ParseHexList(Value(args, ref i), error);
+                    break;
+                case "--landblocks":
+                    landblockFilter = ParseHexList(Value(args, ref i), error);
+                    break;
+                case "--threads":
+                    if (int.TryParse(
+                            Value(args, ref i),
+                            NumberStyles.Integer,
+                            CultureInfo.InvariantCulture,
+                            out int parsedThreads)
+                        && parsedThreads > 0)
+                    {
+                        threads = parsedThreads;
+                    }
+                    break;
+                case "--progress-json":
+                    progressJson = true;
+                    break;
+                default:
+                    error.WriteLine($"unrecognized argument: {args[i]}");
+                    options = null;
+                    return false;
+            }
+        }
+
+        if (string.IsNullOrWhiteSpace(datDirectory))
+        {
+            error.WriteLine(Usage);
+            options = null;
+            return false;
+        }
+
+        outputPath ??= Path.Combine(datDirectory, "acdream.pak");
+        options = new BakeCommandLineOptions(
+            datDirectory,
+            outputPath,
+            idFilter,
+            landblockFilter,
+            threads,
+            progressJson);
+        return true;
+    }
+
+    private static string? Value(IReadOnlyList<string> args, ref int index) =>
+        index + 1 < args.Count ? args[++index] : null;
+
+    private static HashSet<uint> ParseHexList(string? raw, TextWriter error)
+    {
+        var result = new HashSet<uint>();
+        if (string.IsNullOrWhiteSpace(raw))
+        {
+            return result;
+        }
+
+        foreach (string token in raw.Split(
+                     ',',
+                     StringSplitOptions.RemoveEmptyEntries
+                     | StringSplitOptions.TrimEntries))
+        {
+            string hex = token.StartsWith("0x", StringComparison.OrdinalIgnoreCase)
+                ? token[2..]
+                : token;
+            if (uint.TryParse(
+                    hex,
+                    NumberStyles.HexNumber,
+                    CultureInfo.InvariantCulture,
+                    out uint value))
+            {
+                result.Add(value);
+            }
+            else
+            {
+                error.WriteLine($"warning: could not parse id '{token}' - skipped");
+            }
+        }
+
+        return result;
+    }
+}

src/AcDream.Bake/BakeOutputTransaction.cs

@@ -9,11 +9,28 @@ namespace AcDream.Bake;
 /// </summary>
 public static class BakeOutputTransaction
 {
+    internal const string StagingMarker = ".acdream-bake.";
+
     public static TResult WriteValidateAndPublish<TResult>(
         string destinationPath,
         Func<string, TResult> writeTemporary,
         Action<string, TResult> validateTemporary,
         CancellationToken cancellationToken = default)
+        => WriteValidateAndPublish(
+            destinationPath,
+            writeTemporary,
+            validateTemporary,
+            beforePublicationLock: null,
+            beforePromotion: null,
+            cancellationToken);
+
+    internal static TResult WriteValidateAndPublish<TResult>(
+        string destinationPath,
+        Func<string, TResult> writeTemporary,
+        Action<string, TResult> validateTemporary,
+        Action? beforePublicationLock,
+        Action? beforePromotion,
+        CancellationToken cancellationToken = default)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(destinationPath);
         ArgumentNullException.ThrowIfNull(writeTemporary);
@@ -25,9 +42,7 @@ public static class BakeOutputTransaction
             throw new InvalidOperationException("destination has no parent directory");
         Directory.CreateDirectory(directory);
 
-        string temporaryPath = Path.Combine(
-            directory,
-            $".{Path.GetFileName(fullDestination)}.{Guid.NewGuid():N}.tmp");
+        string temporaryPath = CreateStagingPath(fullDestination, Guid.NewGuid());
 
         try
         {
@@ -36,6 +51,14 @@ public static class BakeOutputTransaction
             cancellationToken.ThrowIfCancellationRequested();
             validateTemporary(temporaryPath, result);
             cancellationToken.ThrowIfCancellationRequested();
+            beforePublicationLock?.Invoke();
+            using IDisposable? publication =
+                BakePublicationGuard.AcquireIfRequested(
+                    fullDestination,
+                    cancellationToken);
+            cancellationToken.ThrowIfCancellationRequested();
+            beforePromotion?.Invoke();
+            cancellationToken.ThrowIfCancellationRequested();
 
             // Same-volume MoveFileEx/rename is the publication primitive.
             // File.Replace additionally performs destination metadata/backup
@@ -60,4 +83,21 @@ public static class BakeOutputTransaction
             }
         }
     }
+
+    /// <summary>
+    /// Exact adjacent staging-name contract shared, by documentation and
+    /// conformance tests, with Launcher.Core. Keeping this tiny contract in
+    /// each BCL-facing assembly avoids an otherwise inverted project edge.
+    /// </summary>
+    internal static string CreateStagingPath(string destinationPath, Guid transactionId)
+    {
+        string fullDestination = Path.GetFullPath(destinationPath);
+        string directory = Path.GetDirectoryName(fullDestination)
+            ?? throw new InvalidOperationException(
+                "destination has no parent directory");
+        return Path.Combine(
+            directory,
+            $".{Path.GetFileName(fullDestination)}{StagingMarker}"
+                + $"{transactionId:N}.tmp");
+    }
 }

src/AcDream.Bake/BakeProgressJsonWriter.cs

@@ -0,0 +1,101 @@
+using System.Text.Json;
+
+namespace AcDream.Bake;
+
+public interface IBakeProgressSink
+{
+    void Started(uint bakeToolVersion, string outputPath);
+
+    void Progress(
+        string phase,
+        long completed,
+        long total,
+        int failures,
+        double elapsedSeconds,
+        double etaSeconds,
+        long privateBytes,
+        long managedBytes);
+
+    void Completed(uint bakeToolVersion, long outputBytes, int failures);
+
+    void Error(string message);
+}
+
+/// <summary>
+/// Version-1 JSON-lines machine channel enabled only by
+/// <c>--progress-json</c>. Ordinary human console lines remain unchanged and
+/// share stdout; consumers identify these records by shape instead of
+/// scraping human prose.
+/// </summary>
+public sealed class BakeProgressJsonWriter(TextWriter output) : IBakeProgressSink
+{
+    public const int CurrentVersion = 1;
+
+    private readonly TextWriter _output = output
+        ?? throw new ArgumentNullException(nameof(output));
+    private readonly object _gate = new();
+
+    public void Started(uint bakeToolVersion, string outputPath) =>
+        Write(new
+        {
+            v = CurrentVersion,
+            e = "started",
+            t = DateTimeOffset.UtcNow,
+            bakeToolVersion,
+            outputPath,
+        });
+
+    public void Progress(
+        string phase,
+        long completed,
+        long total,
+        int failures,
+        double elapsedSeconds,
+        double etaSeconds,
+        long privateBytes,
+        long managedBytes) =>
+        Write(new
+        {
+            v = CurrentVersion,
+            e = "progress",
+            t = DateTimeOffset.UtcNow,
+            phase,
+            completed,
+            total,
+            failures,
+            elapsedSeconds,
+            etaSeconds,
+            privateBytes,
+            managedBytes,
+        });
+
+    public void Completed(uint bakeToolVersion, long outputBytes, int failures) =>
+        Write(new
+        {
+            v = CurrentVersion,
+            e = "completed",
+            t = DateTimeOffset.UtcNow,
+            bakeToolVersion,
+            outputBytes,
+            failures,
+        });
+
+    public void Error(string message) =>
+        Write(new
+        {
+            v = CurrentVersion,
+            e = "error",
+            t = DateTimeOffset.UtcNow,
+            message,
+        });
+
+    private void Write<T>(T value)
+    {
+        string line = JsonSerializer.Serialize(value);
+        lock (_gate)
+        {
+            _output.WriteLine(line);
+            _output.Flush();
+        }
+    }
+}

src/AcDream.Bake/BakeProgressReporter.cs

@@ -0,0 +1,34 @@
+namespace AcDream.Bake;
+
+internal static class BakeProgressReporter
+{
+    public static void Write(
+        TextWriter humanOutput,
+        IBakeProgressSink? machineOutput,
+        string phase,
+        long completed,
+        int total,
+        int failures,
+        TimeSpan elapsed,
+        double etaSeconds,
+        long privateBytes,
+        long managedBytes)
+    {
+        ArgumentNullException.ThrowIfNull(humanOutput);
+        humanOutput.WriteLine(
+            $"[{elapsed:hh\\:mm\\:ss}] extracted {completed:N0}/{total:N0}, "
+            + $"failures={failures:N0}, elapsed={elapsed.TotalSeconds:F0}s, "
+            + $"ETA={etaSeconds:F0}s, "
+            + $"private={privateBytes / 1024.0 / 1024.0:F0}MB, "
+            + $"managed={managedBytes / 1024.0 / 1024.0:F0}MB");
+        machineOutput?.Progress(
+            phase,
+            completed,
+            total,
+            failures,
+            elapsed.TotalSeconds,
+            etaSeconds,
+            privateBytes,
+            managedBytes);
+    }
+}

src/AcDream.Bake/BakePublicationGuard.cs

@@ -0,0 +1,80 @@
+using AcDream.Platform;
+
+namespace AcDream.Bake;
+
+/// <summary>
+/// Optional launcher authorization checked immediately before atomic
+/// publication. Standalone Bake runs have no nonce environment variable and
+/// retain the original unguarded behavior.
+/// </summary>
+internal static class BakePublicationGuard
+{
+    private static readonly TimeSpan RetryDelay = TimeSpan.FromMilliseconds(50);
+
+    internal static IDisposable? AcquireIfRequested(
+        string outputPath,
+        CancellationToken cancellationToken)
+    {
+        string? nonce = Environment.GetEnvironmentVariable(
+            BakePublicationGuardPaths.NonceEnvironmentVariable);
+        if (nonce is null)
+        {
+            return null;
+        }
+
+        if (!BakePublicationGuardPaths.IsValidNonce(nonce))
+        {
+            throw new InvalidOperationException(
+                "The launcher bake publication nonce is invalid.");
+        }
+
+        string lockPath = BakePublicationGuardPaths.GetPublishLockPath(
+            outputPath);
+        Directory.CreateDirectory(
+            Path.GetDirectoryName(lockPath)
+            ?? throw new InvalidOperationException(
+                "The bake publication lock has no parent directory."));
+
+        FileStream? lease = null;
+        while (lease is null)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            try
+            {
+                lease = new FileStream(
+                    lockPath,
+                    FileMode.OpenOrCreate,
+                    FileAccess.ReadWrite,
+                    FileShare.None,
+                    bufferSize: 1,
+                    options: FileOptions.None);
+            }
+            catch (IOException)
+            {
+                cancellationToken.WaitHandle.WaitOne(RetryDelay);
+            }
+        }
+
+        try
+        {
+            string authorizationPath =
+                BakePublicationGuardPaths.GetAuthorizationPath(outputPath);
+            string authorized = File.Exists(authorizationPath)
+                ? File.ReadAllText(authorizationPath)
+                : string.Empty;
+            if (!string.Equals(authorized, nonce, StringComparison.Ordinal))
+            {
+                throw new InvalidOperationException(
+                    "This bake process is no longer authorized to publish its output.");
+            }
+
+            return lease;
+        }
+        catch
+        {
+            lease.Dispose();
+            throw;
+        }
+    }
+
+}

src/AcDream.Bake/BakeRunner.cs

@@ -22,6 +22,7 @@ public sealed record BakeOptions
     public HashSet<uint>? LandblockFilter { get; init; }
     public int Threads { get; init; } = System.Environment.ProcessorCount;
     public CancellationToken CancellationToken { get; init; }
+    public IBakeProgressSink? Progress { get; init; }
 }
 
 /// <summary>Compact result used by the full-scale gate and deterministic tests.</summary>
@@ -89,6 +90,7 @@ public static class BakeRunner
             throw new ArgumentOutOfRangeException(nameof(options), "thread count must be positive");
 
         options.CancellationToken.ThrowIfCancellationRequested();
+        options.Progress?.Started(PakFormat.CurrentBakeToolVersion, options.OutPath);
         var totalStopwatch = Stopwatch.StartNew();
         var report = BakeOutputTransaction.WriteValidateAndPublish(
             options.OutPath,
@@ -112,6 +114,10 @@ public static class BakeRunner
         };
 
         PrintSummary(report, options.OutPath);
+        options.Progress?.Completed(
+            report.Header.BakeToolVersion,
+            report.OutputBytes,
+            report.Failures);
         return report;
     }
 
@@ -273,6 +279,8 @@ public static class BakeRunner
                     failures.Count,
                     stopwatch.Elapsed,
                     lastProgressReport,
+                    options.Progress,
+                    "mesh",
                     batchStart + BatchSize >= ordinaryWork.Count &&
                     envCatalog.UniqueGeometryCount == 0);
             }
@@ -372,6 +380,8 @@ public static class BakeRunner
                     failures.Count,
                     stopwatch.Elapsed,
                     lastProgressReport,
+                    options.Progress,
+                    "mesh",
                     batchStart + BatchSize >= envCatalog.Groups.Count);
             }
 
@@ -571,6 +581,8 @@ public static class BakeRunner
                     failures.Count,
                     collisionStopwatch.Elapsed,
                     lastProgressReport,
+                    options.Progress,
+                    "collision",
                     final: false);
             }
 
@@ -757,6 +769,8 @@ public static class BakeRunner
                             failures.Count,
                             collisionStopwatch.Elapsed,
                             lastProgressReport,
+                            options.Progress,
+                            "collision",
                             final: false);
                     }
                 }
@@ -769,6 +783,8 @@ public static class BakeRunner
                 failures.Count,
                 collisionStopwatch.Elapsed,
                 lastProgressReport,
+                options.Progress,
+                "collision",
                 final: true);
 
             writer.Finish();
@@ -910,6 +926,8 @@ public static class BakeRunner
         int failures,
         TimeSpan elapsed,
         Stopwatch lastProgressReport,
+        IBakeProgressSink? progress,
+        string phase,
         bool final)
     {
         if (!final && lastProgressReport.Elapsed.TotalSeconds < 5)
@@ -920,11 +938,18 @@ public static class BakeRunner
         using var process = Process.GetCurrentProcess();
         process.Refresh();
         long managedHeap = GC.GetGCMemoryInfo().HeapSizeBytes;
-        Console.WriteLine(
-            $"[{elapsed:hh\\:mm\\:ss}] extracted {done:N0}/{total:N0}, " +
-            $"failures={failures:N0}, elapsed={elapsed.TotalSeconds:F0}s, " +
-            $"ETA={etaSeconds:F0}s, private={process.PrivateMemorySize64 / 1024.0 / 1024.0:F0}MB, " +
-            $"managed={managedHeap / 1024.0 / 1024.0:F0}MB");
+        long privateBytes = process.PrivateMemorySize64;
+        BakeProgressReporter.Write(
+            Console.Out,
+            progress,
+            phase,
+            done,
+            total,
+            failures,
+            elapsed,
+            etaSeconds,
+            privateBytes,
+            managedHeap);
         lastProgressReport.Restart();
     }
 

src/AcDream.Bake/Program.cs

@@ -1,7 +1,3 @@
-using System;
-using System.Collections.Generic;
-using System.IO;
-using System.Linq;
 using AcDream.Bake;
 
 // acdream-bake: offline CLI producing a versioned pak file containing every
@@ -13,66 +9,41 @@ using AcDream.Bake;
 //
 // Plan: docs/superpowers/plans/2026-07-05-mp1b-pak-and-bake.md, Task 5.
 
-string? datDir = null;
-string? outPath = null;
-HashSet<uint>? idFilter = null;
-HashSet<uint>? landblockFilter = null;
-int threads = Environment.ProcessorCount;
-
-for (int i = 0; i < args.Length; i++) {
-    switch (args[i]) {
-        case "--dat-dir":
-            datDir = args.ElementAtOrDefault(++i);
-            break;
-        case "--out":
-            outPath = args.ElementAtOrDefault(++i);
-            break;
-        case "--ids":
-            idFilter = ParseHexList(args.ElementAtOrDefault(++i));
-            break;
-        case "--landblocks":
-            landblockFilter = ParseHexList(args.ElementAtOrDefault(++i));
-            break;
-        case "--threads":
-            if (int.TryParse(args.ElementAtOrDefault(++i), out var t) && t > 0) threads = t;
-            break;
-        default:
-            Console.Error.WriteLine($"unrecognized argument: {args[i]}");
-            return 2;
-    }
+if (BakeCommandLine.IsHelpRequest(args))
+{
+    Console.Out.WriteLine(BakeCommandLine.Usage);
+    return 0;
 }
 
-if (string.IsNullOrWhiteSpace(datDir)) {
-    Console.Error.WriteLine("usage: acdream-bake --dat-dir <path> [--out <file>] [--ids 0xId,0xId,...] [--landblocks 0xId,...] [--threads <n>]");
+if (!BakeCommandLine.TryParse(args, Console.Error, out BakeCommandLineOptions? command))
+{
     return 2;
 }
 
-if (!Directory.Exists(datDir)) {
-    Console.Error.WriteLine($"error: directory not found: {datDir}");
+if (!Directory.Exists(command!.DatDirectory))
+{
+    Console.Error.WriteLine($"error: directory not found: {command.DatDirectory}");
     return 2;
 }
 
-outPath ??= Path.Combine(datDir, "acdream.pak");
-
-return BakeRunner.Run(new BakeOptions {
-    DatDir = datDir,
-    OutPath = outPath,
-    IdFilter = idFilter,
-    LandblockFilter = landblockFilter,
-    Threads = threads,
-});
-
-static HashSet<uint> ParseHexList(string? raw) {
-    var result = new HashSet<uint>();
-    if (string.IsNullOrWhiteSpace(raw)) return result;
-    foreach (var token in raw.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries)) {
-        var hex = token.StartsWith("0x", StringComparison.OrdinalIgnoreCase) ? token[2..] : token;
-        if (uint.TryParse(hex, System.Globalization.NumberStyles.HexNumber, null, out var value)) {
-            result.Add(value);
-        }
-        else {
-            Console.Error.WriteLine($"warning: could not parse id '{token}' — skipped");
-        }
-    }
-    return result;
+IBakeProgressSink? progress = command.ProgressJson
+    ? new BakeProgressJsonWriter(Console.Out)
+    : null;
+try
+{
+    return BakeRunner.Run(new BakeOptions
+    {
+        DatDir = command.DatDirectory,
+        OutPath = command.OutputPath,
+        IdFilter = command.IdFilter,
+        LandblockFilter = command.LandblockFilter,
+        Threads = command.Threads,
+        Progress = progress,
+    });
+}
+catch (Exception exception)
+{
+    progress?.Error(exception.Message);
+    Console.Error.WriteLine($"error: {exception.Message}");
+    return 1;
 }

src/AcDream.Launcher.Core/AcDream.Launcher.Core.csproj

@@ -14,6 +14,7 @@
   </PropertyGroup>
   <ItemGroup>
     <InternalsVisibleTo Include="AcDream.Launcher.Core.Tests" />
+    <InternalsVisibleTo Include="AcDream.Launcher.Core.Tests.Fixtures.InstallLeaseHolder" />
   </ItemGroup>
   <ItemGroup>
     <ProjectReference Include="..\AcDream.Platform\AcDream.Platform.csproj" />

src/AcDream.Launcher.Core/Installation/BakeOutputStagingContract.cs

@@ -0,0 +1,72 @@
+namespace AcDream.Launcher.Core.Installation;
+
+/// <summary>
+/// Exact adjacent temporary-file contract emitted by AcDream.Bake's
+/// BakeOutputTransaction. This class intentionally has no Bake project
+/// dependency: both sides pin the same documented format with conformance
+/// tests so Launcher.Core remains BCL-only.
+/// </summary>
+internal static class BakeOutputStagingContract
+{
+    internal const string StagingMarker = ".acdream-bake.";
+    private const string Suffix = ".tmp";
+
+    internal static string CreateStagingPath(
+        string destinationPath,
+        Guid transactionId)
+    {
+        string fullDestination = Path.GetFullPath(destinationPath);
+        string directory = Path.GetDirectoryName(fullDestination)
+            ?? throw new InvalidOperationException(
+                "The prepared package path has no parent directory.");
+        return Path.Combine(
+            directory,
+            $".{Path.GetFileName(fullDestination)}{StagingMarker}"
+                + $"{transactionId:N}{Suffix}");
+    }
+
+    internal static bool IsOwnedStagingFileName(
+        string fileName,
+        string destinationFileName)
+    {
+        string prefix = $".{destinationFileName}{StagingMarker}";
+        if (!fileName.StartsWith(prefix, StringComparison.Ordinal)
+            || !fileName.EndsWith(Suffix, StringComparison.Ordinal)
+            || fileName.Length != prefix.Length + 32 + Suffix.Length)
+        {
+            return false;
+        }
+
+        ReadOnlySpan<char> transaction = fileName.AsSpan(prefix.Length, 32);
+        return Guid.TryParseExact(transaction, "N", out _);
+    }
+
+    internal static void DeleteOwnedStagingFiles(string destinationPath)
+    {
+        string fullDestination = Path.GetFullPath(destinationPath);
+        string? directory = Path.GetDirectoryName(fullDestination);
+        if (string.IsNullOrEmpty(directory) || !Directory.Exists(directory))
+        {
+            return;
+        }
+
+        string destinationFileName = Path.GetFileName(fullDestination);
+        try
+        {
+            foreach (string candidate in Directory.EnumerateFiles(directory))
+            {
+                if (IsOwnedStagingFileName(
+                        Path.GetFileName(candidate),
+                        destinationFileName))
+                {
+                    LauncherInstallRecordStore.TryDelete(candidate);
+                }
+            }
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            // Best effort: these files are never launchable. A later startup
+            // retries exact-name cleanup under the publication lock.
+        }
+    }
+}

src/AcDream.Launcher.Core/Installation/BakeProcessRunner.cs

@@ -0,0 +1,198 @@
+using System.Diagnostics;
+using System.Globalization;
+using System.Text;
+using AcDream.Platform;
+
+namespace AcDream.Launcher.Core.Installation;
+
+/// <summary>The exact child-process contract for one launcher bake.</summary>
+public sealed record BakeProcessRequest(
+    string ExecutablePath,
+    string DatDirectory,
+    string OutputPath,
+    int Threads,
+    string? PublicationNonce = null)
+{
+    public IReadOnlyList<string> Arguments =>
+    [
+        "--dat-dir",
+        DatDirectory,
+        "--out",
+        OutputPath,
+        "--threads",
+        Threads.ToString(CultureInfo.InvariantCulture),
+        "--progress-json",
+    ];
+}
+
+public sealed record BakeProcessResult(int ExitCode, string StandardError);
+
+/// <summary>
+/// Injectable child seam. Stdout is delivered as arbitrary chunks so the
+/// versioned JSONL parser, rather than line-oriented process plumbing, owns
+/// partial-record behavior.
+/// </summary>
+public interface IBakeProcessRunner
+{
+    Task<BakeProcessResult> RunAsync(
+        BakeProcessRequest request,
+        Action<string> onStandardOutput,
+        CancellationToken cancellationToken = default);
+}
+
+public sealed class SystemBakeProcessRunner : IBakeProcessRunner
+{
+    private const int BufferSize = 4096;
+    private const int MaximumCapturedErrorCharacters = 32 * 1024;
+
+    public async Task<BakeProcessResult> RunAsync(
+        BakeProcessRequest request,
+        Action<string> onStandardOutput,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(request);
+        ArgumentNullException.ThrowIfNull(onStandardOutput);
+        if (request.Threads <= 0)
+        {
+            throw new ArgumentOutOfRangeException(
+                nameof(request),
+                "Bake thread count must be positive.");
+        }
+
+        cancellationToken.ThrowIfCancellationRequested();
+
+        ProcessStartInfo startInfo = CreateStartInfo(request);
+
+        using var process = new Process { StartInfo = startInfo };
+        if (!process.Start())
+        {
+            throw new InvalidOperationException("The bake process could not be started.");
+        }
+
+        // The bake consumes no credential or other stdin input.
+        process.StandardInput.Close();
+
+        var standardError = new StringBuilder();
+        Task stdoutPump = PumpAsync(
+            process.StandardOutput,
+            onStandardOutput,
+            CancellationToken.None);
+        Task stderrPump = PumpAsync(
+            process.StandardError,
+            chunk => AppendBounded(standardError, chunk),
+            CancellationToken.None);
+
+        using CancellationTokenRegistration cancellation = cancellationToken.Register(
+            static state =>
+            {
+                var child = (Process)state!;
+                try
+                {
+                    if (!child.HasExited)
+                    {
+                        child.Kill(entireProcessTree: true);
+                    }
+                }
+                catch
+                {
+                    // The cancellation token remains authoritative. Races with
+                    // natural exit or handle teardown do not replace it.
+                }
+            },
+            process);
+
+        try
+        {
+            await process.WaitForExitAsync(cancellationToken).ConfigureAwait(false);
+            await Task.WhenAll(stdoutPump, stderrPump).ConfigureAwait(false);
+            cancellationToken.ThrowIfCancellationRequested();
+            return new BakeProcessResult(process.ExitCode, standardError.ToString());
+        }
+        catch (OperationCanceledException)
+        {
+            try
+            {
+                using var cleanupTimeout = new CancellationTokenSource(
+                    TimeSpan.FromSeconds(5));
+                await process.WaitForExitAsync(cleanupTimeout.Token)
+                    .ConfigureAwait(false);
+                await Task.WhenAll(stdoutPump, stderrPump)
+                    .WaitAsync(cleanupTimeout.Token)
+                    .ConfigureAwait(false);
+            }
+            catch
+            {
+                // Preserve cancellation. The process kill registration above
+                // already made the best effort to terminate the tree.
+            }
+
+            throw;
+        }
+    }
+
+    internal static ProcessStartInfo CreateStartInfo(BakeProcessRequest request)
+    {
+        ArgumentNullException.ThrowIfNull(request);
+        var startInfo = new ProcessStartInfo
+        {
+            FileName = request.ExecutablePath,
+            UseShellExecute = false,
+            RedirectStandardInput = true,
+            RedirectStandardOutput = true,
+            RedirectStandardError = true,
+            CreateNoWindow = true,
+        };
+        foreach (string argument in request.Arguments)
+        {
+            startInfo.ArgumentList.Add(argument);
+        }
+        startInfo.Environment.Remove(
+            BakePublicationGuardPaths.NonceEnvironmentVariable);
+        if (request.PublicationNonce is not null)
+        {
+            if (!BakePublicationGuardPaths.IsValidNonce(
+                    request.PublicationNonce))
+            {
+                throw new ArgumentException(
+                    "The bake publication nonce is invalid.",
+                    nameof(request));
+            }
+
+            startInfo.Environment[
+                BakePublicationGuardPaths.NonceEnvironmentVariable] =
+                request.PublicationNonce;
+        }
+
+        return startInfo;
+    }
+
+    private static async Task PumpAsync(
+        TextReader reader,
+        Action<string> sink,
+        CancellationToken cancellationToken)
+    {
+        char[] buffer = new char[BufferSize];
+        while (true)
+        {
+            int read = await reader.ReadAsync(buffer, cancellationToken)
+                .ConfigureAwait(false);
+            if (read == 0)
+            {
+                return;
+            }
+
+            sink(new string(buffer, 0, read));
+        }
+    }
+
+    private static void AppendBounded(StringBuilder destination, string chunk)
+    {
+        int remaining = MaximumCapturedErrorCharacters - destination.Length;
+        if (remaining <= 0)
+        {
+            return;
+        }
+
+        destination.Append(chunk.AsSpan(0, Math.Min(remaining, chunk.Length)));
+    }
+}

src/AcDream.Launcher.Core/Installation/BakeProgressEvent.cs

@@ -0,0 +1,54 @@
+namespace AcDream.Launcher.Core.Installation;
+
+/// <summary>
+/// Versioned machine-readable output from <c>acdream-bake
+/// --progress-json</c>. Human output shares stdout but remains a distinct
+/// event so the installer never derives state by scraping prose.
+/// </summary>
+public abstract record BakeProgressEvent(int Version, string EventName);
+
+public sealed record BakeStartedEvent(
+    int Version,
+    uint BakeToolVersion,
+    string? OutputPath)
+    : BakeProgressEvent(Version, "started");
+
+public sealed record BakeWorkProgressEvent(
+    int Version,
+    string Phase,
+    long Completed,
+    long Total,
+    int Failures,
+    double ElapsedSeconds,
+    double EtaSeconds)
+    : BakeProgressEvent(Version, "progress");
+
+public sealed record BakeCompletedEvent(
+    int Version,
+    uint BakeToolVersion,
+    long OutputBytes,
+    int Failures)
+    : BakeProgressEvent(Version, "completed");
+
+public sealed record BakeErrorEvent(int Version, string Message)
+    : BakeProgressEvent(Version, "error");
+
+public sealed record UnknownBakeProgressEvent(
+    int Version,
+    string EventName,
+    string RawLine)
+    : BakeProgressEvent(Version, EventName);
+
+public sealed record FutureBakeProgressEvent(
+    int Version,
+    string EventName,
+    string RawLine)
+    : BakeProgressEvent(Version, EventName);
+
+public sealed record MalformedBakeProgressEvent(
+    string RawLine,
+    string Reason)
+    : BakeProgressEvent(0, "malformed");
+
+public sealed record BakeHumanOutputEvent(string Text)
+    : BakeProgressEvent(0, "human");

src/AcDream.Launcher.Core/Installation/BakeProgressJsonlParser.cs

@@ -0,0 +1,230 @@
+using System.Text;
+using System.Text.Json;
+
+namespace AcDream.Launcher.Core.Installation;
+
+/// <summary>
+/// Incremental JSONL parser tolerant of arbitrary stream chunk boundaries.
+/// Unknown event names and future protocol versions stay observable without
+/// failing the bake; malformed known payloads are explicit typed events.
+/// </summary>
+public sealed class BakeProgressJsonlParser
+{
+    public const int CurrentVersion = 1;
+
+    private readonly StringBuilder _pending = new();
+
+    public IReadOnlyList<BakeProgressEvent> Append(string chunk)
+    {
+        ArgumentNullException.ThrowIfNull(chunk);
+        _pending.Append(chunk);
+        return Drain(completeFinalLine: false);
+    }
+
+    public IReadOnlyList<BakeProgressEvent> Complete() =>
+        Drain(completeFinalLine: true);
+
+    public static BakeProgressEvent ParseLine(string line)
+    {
+        ArgumentNullException.ThrowIfNull(line);
+        string trimmed = line.Trim();
+        if (trimmed.Length == 0)
+        {
+            return new BakeHumanOutputEvent(string.Empty);
+        }
+
+        if (trimmed[0] != '{')
+        {
+            return new BakeHumanOutputEvent(line.TrimEnd('\r'));
+        }
+
+        try
+        {
+            using JsonDocument document = JsonDocument.Parse(trimmed);
+            JsonElement root = document.RootElement;
+            if (root.ValueKind != JsonValueKind.Object
+                || !TryGetInt32(root, "v", out int version)
+                || !TryGetString(root, "e", out string? eventName))
+            {
+                return Malformed(line, "JSON progress requires integer 'v' and string 'e'.");
+            }
+
+            if (version != CurrentVersion)
+            {
+                return new FutureBakeProgressEvent(version, eventName!, line);
+            }
+
+            return eventName switch
+            {
+                "started" => ParseStarted(root, version, line),
+                "progress" => ParseProgress(root, version, line),
+                "completed" => ParseCompleted(root, version, line),
+                "error" => ParseError(root, version, line),
+                _ => new UnknownBakeProgressEvent(version, eventName!, line),
+            };
+        }
+        catch (JsonException ex)
+        {
+            return Malformed(line, ex.Message);
+        }
+    }
+
+    private IReadOnlyList<BakeProgressEvent> Drain(bool completeFinalLine)
+    {
+        var events = new List<BakeProgressEvent>();
+        while (true)
+        {
+            int newline = IndexOfNewline(_pending);
+            if (newline < 0)
+            {
+                break;
+            }
+
+            string line = _pending.ToString(0, newline);
+            _pending.Remove(0, newline + 1);
+            events.Add(ParseLine(line));
+        }
+
+        if (completeFinalLine && _pending.Length > 0)
+        {
+            string line = _pending.ToString();
+            _pending.Clear();
+            events.Add(ParseLine(line));
+        }
+
+        return events;
+    }
+
+    private static int IndexOfNewline(StringBuilder value)
+    {
+        for (int i = 0; i < value.Length; i++)
+        {
+            if (value[i] == '\n')
+            {
+                return i;
+            }
+        }
+
+        return -1;
+    }
+
+    private static BakeProgressEvent ParseStarted(
+        JsonElement root,
+        int version,
+        string raw)
+    {
+        if (!TryGetUInt32(root, "bakeToolVersion", out uint bakeToolVersion)
+            || bakeToolVersion == 0)
+        {
+            return Malformed(raw, "started requires a positive bakeToolVersion.");
+        }
+
+        _ = TryGetString(root, "outputPath", out string? outputPath);
+        return new BakeStartedEvent(version, bakeToolVersion, outputPath);
+    }
+
+    private static BakeProgressEvent ParseProgress(
+        JsonElement root,
+        int version,
+        string raw)
+    {
+        if (!TryGetString(root, "phase", out string? phase)
+            || !TryGetInt64(root, "completed", out long completed)
+            || !TryGetInt64(root, "total", out long total)
+            || !TryGetInt32(root, "failures", out int failures)
+            || !TryGetDouble(root, "elapsedSeconds", out double elapsedSeconds)
+            || !TryGetDouble(root, "etaSeconds", out double etaSeconds)
+            || completed < 0
+            || total < 0
+            || completed > total
+            || failures < 0
+            || elapsedSeconds < 0
+            || etaSeconds < 0)
+        {
+            return Malformed(raw, "progress payload has missing or invalid fields.");
+        }
+
+        return new BakeWorkProgressEvent(
+            version,
+            phase!,
+            completed,
+            total,
+            failures,
+            elapsedSeconds,
+            etaSeconds);
+    }
+
+    private static BakeProgressEvent ParseCompleted(
+        JsonElement root,
+        int version,
+        string raw)
+    {
+        if (!TryGetUInt32(root, "bakeToolVersion", out uint bakeToolVersion)
+            || !TryGetInt64(root, "outputBytes", out long outputBytes)
+            || !TryGetInt32(root, "failures", out int failures)
+            || bakeToolVersion == 0
+            || outputBytes <= 0
+            || failures < 0)
+        {
+            return Malformed(raw, "completed payload has missing or invalid fields.");
+        }
+
+        return new BakeCompletedEvent(
+            version,
+            bakeToolVersion,
+            outputBytes,
+            failures);
+    }
+
+    private static BakeProgressEvent ParseError(
+        JsonElement root,
+        int version,
+        string raw) =>
+        TryGetString(root, "message", out string? message)
+        && !string.IsNullOrWhiteSpace(message)
+            ? new BakeErrorEvent(version, message)
+            : Malformed(raw, "error requires a non-empty message.");
+
+    private static MalformedBakeProgressEvent Malformed(string raw, string reason) =>
+        new(raw, reason);
+
+    private static bool TryGetString(
+        JsonElement root,
+        string name,
+        out string? value)
+    {
+        value = null;
+        return root.TryGetProperty(name, out JsonElement element)
+            && element.ValueKind == JsonValueKind.String
+            && (value = element.GetString()) is not null;
+    }
+
+    private static bool TryGetInt32(JsonElement root, string name, out int value)
+    {
+        value = default;
+        return root.TryGetProperty(name, out JsonElement element)
+            && element.TryGetInt32(out value);
+    }
+
+    private static bool TryGetUInt32(JsonElement root, string name, out uint value)
+    {
+        value = default;
+        return root.TryGetProperty(name, out JsonElement element)
+            && element.TryGetUInt32(out value);
+    }
+
+    private static bool TryGetInt64(JsonElement root, string name, out long value)
+    {
+        value = default;
+        return root.TryGetProperty(name, out JsonElement element)
+            && element.TryGetInt64(out value);
+    }
+
+    private static bool TryGetDouble(JsonElement root, string name, out double value)
+    {
+        value = default;
+        return root.TryGetProperty(name, out JsonElement element)
+            && element.TryGetDouble(out value)
+            && double.IsFinite(value);
+    }
+}

src/AcDream.Launcher.Core/Installation/BakeProgressProtocol.cs

@@ -0,0 +1,121 @@
+namespace AcDream.Launcher.Core.Installation;
+
+/// <summary>
+/// Strict state machine for known v1 bake events. Human output, unknown v1
+/// events, and future versions are deliberately transparent; known v1 events
+/// cannot be reordered, duplicated, or appended after the first terminal.
+/// </summary>
+internal sealed class BakeProgressProtocol
+{
+    private BakeProgressProtocolState _state;
+
+    internal BakeStartedEvent? Started { get; private set; }
+
+    internal BakeCompletedEvent? Completed { get; private set; }
+
+    internal BakeErrorEvent? Error { get; private set; }
+
+    internal string? Violation { get; private set; }
+
+    internal bool Observe(BakeProgressEvent progressEvent)
+    {
+        ArgumentNullException.ThrowIfNull(progressEvent);
+        if (Violation is not null)
+        {
+            return false;
+        }
+
+        switch (progressEvent)
+        {
+            case BakeHumanOutputEvent:
+            case UnknownBakeProgressEvent:
+            case FutureBakeProgressEvent:
+                return true;
+            case MalformedBakeProgressEvent malformed:
+                Reject($"Malformed bake progress: {malformed.Reason}");
+                return false;
+            case BakeStartedEvent started:
+                if (_state != BakeProgressProtocolState.AwaitingStarted)
+                {
+                    Reject(_state == BakeProgressProtocolState.Running
+                        ? "The bake protocol emitted more than one v1 started event."
+                        : "The bake protocol emitted a known event after its terminal event.");
+                    return false;
+                }
+
+                Started = started;
+                _state = BakeProgressProtocolState.Running;
+                return true;
+            case BakeWorkProgressEvent:
+                if (_state != BakeProgressProtocolState.Running)
+                {
+                    Reject(KnownEventStateViolation("progress"));
+                    return false;
+                }
+
+                return true;
+            case BakeCompletedEvent completed:
+                if (_state != BakeProgressProtocolState.Running)
+                {
+                    Reject(KnownEventStateViolation("completed"));
+                    return false;
+                }
+
+                Completed = completed;
+                _state = BakeProgressProtocolState.Completed;
+                return true;
+            case BakeErrorEvent error:
+                if (_state != BakeProgressProtocolState.Running)
+                {
+                    Reject(KnownEventStateViolation("error"));
+                    return false;
+                }
+
+                Error = error;
+                _state = BakeProgressProtocolState.Error;
+                return true;
+            default:
+                Reject("The bake protocol emitted an unsupported known event.");
+                return false;
+        }
+    }
+
+    internal void CompleteInput()
+    {
+        if (Violation is not null)
+        {
+            return;
+        }
+
+        if (_state == BakeProgressProtocolState.AwaitingStarted)
+        {
+            Reject("The bake protocol did not emit a v1 started event first.");
+        }
+        else if (_state == BakeProgressProtocolState.Running)
+        {
+            Reject("The bake protocol ended without exactly one terminal event.");
+        }
+    }
+
+    private string KnownEventStateViolation(string eventName) => _state switch
+    {
+        BakeProgressProtocolState.AwaitingStarted =>
+            $"The bake protocol emitted v1 {eventName} before v1 started.",
+        BakeProgressProtocolState.Running =>
+            $"The bake protocol emitted an invalid v1 {eventName} event.",
+        _ => "The bake protocol emitted a known event after its terminal event.",
+    };
+
+    private void Reject(string message)
+    {
+        Violation ??= message;
+    }
+
+    private enum BakeProgressProtocolState
+    {
+        AwaitingStarted,
+        Running,
+        Completed,
+        Error,
+    }
+}

src/AcDream.Launcher.Core/Installation/BakePublicationGuardContract.cs

@@ -0,0 +1,120 @@
+using AcDream.Platform;
+
+namespace AcDream.Launcher.Core.Installation;
+
+/// <summary>
+/// Launcher half of the environment-only Bake publication guard. Paths are
+/// derived from the canonical output path, while a durable GUID nonce grants
+/// one child permission to promote its already-validated adjacent staging
+/// file. Every token mutation happens while the stable publication lock is
+/// held.
+/// </summary>
+internal static class BakePublicationGuardContract
+{
+    private static readonly TimeSpan RetryDelay = TimeSpan.FromMilliseconds(50);
+
+    internal static async ValueTask<PublicationLease> AcquireAsync(
+        string outputPath,
+        CancellationToken cancellationToken = default)
+    {
+        string lockPath = BakePublicationGuardPaths.GetPublishLockPath(
+            outputPath);
+        Directory.CreateDirectory(
+            Path.GetDirectoryName(lockPath)
+            ?? throw new InvalidOperationException(
+                "The bake publication lock has no parent directory."));
+
+        while (true)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            try
+            {
+                return new PublicationLease(new FileStream(
+                    lockPath,
+                    FileMode.OpenOrCreate,
+                    FileAccess.ReadWrite,
+                    FileShare.None,
+                    bufferSize: 1,
+                    options: FileOptions.None));
+            }
+            catch (IOException)
+            {
+                await Task.Delay(RetryDelay, cancellationToken)
+                    .ConfigureAwait(false);
+            }
+        }
+    }
+
+    internal static void Authorize(
+        string outputPath,
+        string nonce,
+        PublicationLease lease)
+    {
+        ArgumentNullException.ThrowIfNull(lease);
+        if (!BakePublicationGuardPaths.IsValidNonce(nonce))
+        {
+            throw new ArgumentException(
+                "The bake publication nonce must be a lowercase GUID in N format.",
+                nameof(nonce));
+        }
+
+        string authorizationPath =
+            BakePublicationGuardPaths.GetAuthorizationPath(outputPath);
+        using var stream = new FileStream(
+            authorizationPath,
+            FileMode.Create,
+            FileAccess.Write,
+            FileShare.None,
+            bufferSize: 4096,
+            options: FileOptions.WriteThrough);
+        using var writer = new StreamWriter(stream, leaveOpen: true);
+        writer.Write(nonce);
+        writer.Flush();
+        stream.Flush(flushToDisk: true);
+    }
+
+    internal static void Invalidate(
+        string outputPath,
+        PublicationLease lease,
+        string? onlyIfNonceMatches = null)
+    {
+        ArgumentNullException.ThrowIfNull(lease);
+        string authorizationPath =
+            BakePublicationGuardPaths.GetAuthorizationPath(outputPath);
+        if (!File.Exists(authorizationPath))
+        {
+            return;
+        }
+
+        if (onlyIfNonceMatches is not null)
+        {
+            string current = File.ReadAllText(authorizationPath);
+
+            if (!string.Equals(
+                    current,
+                    onlyIfNonceMatches,
+                    StringComparison.Ordinal))
+            {
+                return;
+            }
+        }
+
+        File.Delete(authorizationPath);
+    }
+
+    internal sealed class PublicationLease : IAsyncDisposable
+    {
+        private readonly FileStream _stream;
+
+        internal PublicationLease(FileStream stream)
+        {
+            _stream = stream;
+        }
+
+        public ValueTask DisposeAsync()
+        {
+            _stream.Dispose();
+            return ValueTask.CompletedTask;
+        }
+    }
+}

src/AcDream.Launcher.Core/Installation/DatDirectoryLocator.cs

@@ -0,0 +1,138 @@
+namespace AcDream.Launcher.Core.Installation;
+
+/// <summary>
+/// Portable validation and Windows-only discovery for the four retail data
+/// archives consumed by <c>acdream-bake</c>. Discovery is intentionally only
+/// a list of conventional paths; validation is the same filesystem operation
+/// on Windows and Linux, including for a manually entered path.
+/// </summary>
+public sealed class DatDirectoryLocator
+{
+    public static IReadOnlyList<string> RequiredFileNames { get; } =
+        Array.AsReadOnly<string>(
+        [
+            "client_portal.dat",
+            "client_cell_1.dat",
+            "client_highres.dat",
+            "client_local_English.dat",
+        ]);
+
+    private readonly bool _isWindows;
+    private readonly string[] _windowsCandidates;
+    private readonly Func<string, bool> _directoryExists;
+    private readonly Func<string, bool> _fileExists;
+
+    public DatDirectoryLocator(
+        bool? isWindows = null,
+        IEnumerable<string>? windowsCandidates = null,
+        Func<string, bool>? directoryExists = null,
+        Func<string, bool>? fileExists = null)
+    {
+        _isWindows = isWindows ?? OperatingSystem.IsWindows();
+        _windowsCandidates = (windowsCandidates ?? DefaultWindowsCandidates())
+            .Where(path => !string.IsNullOrWhiteSpace(path))
+            .Select(Path.GetFullPath)
+            .Distinct(StringComparer.OrdinalIgnoreCase)
+            .ToArray();
+        _directoryExists = directoryExists ?? Directory.Exists;
+        _fileExists = fileExists ?? File.Exists;
+    }
+
+    /// <summary>
+    /// Returns conventional Windows locations that actually exist, in
+    /// preference order. An existing but incomplete directory remains in the
+    /// result so the wizard can explain exactly which DATs are missing.
+    /// Linux returns an empty list and relies on the manual picker/path field.
+    /// </summary>
+    public IReadOnlyList<DatDirectoryValidation> Detect()
+    {
+        if (!_isWindows)
+        {
+            return [];
+        }
+
+        return _windowsCandidates
+            .Where(_directoryExists)
+            .Select(Validate)
+            .ToArray();
+    }
+
+    public DatDirectoryValidation Validate(string? directory)
+    {
+        if (string.IsNullOrWhiteSpace(directory))
+        {
+            return DatDirectoryValidation.Invalid(
+                directory ?? string.Empty,
+                "Choose the folder containing the retail DAT files.",
+                RequiredFileNames);
+        }
+
+        string fullPath;
+        try
+        {
+            fullPath = Path.TrimEndingDirectorySeparator(Path.GetFullPath(directory));
+        }
+        catch (Exception ex) when (ex is ArgumentException
+                                   or NotSupportedException
+                                   or PathTooLongException)
+        {
+            return DatDirectoryValidation.Invalid(
+                directory,
+                "The DAT directory path is not valid.",
+                RequiredFileNames);
+        }
+
+        if (!_directoryExists(fullPath))
+        {
+            return DatDirectoryValidation.Invalid(
+                fullPath,
+                "The DAT directory does not exist.",
+                RequiredFileNames);
+        }
+
+        string[] missing = RequiredFileNames
+            .Where(fileName => !_fileExists(Path.Combine(fullPath, fileName)))
+            .ToArray();
+        return missing.Length == 0
+            ? DatDirectoryValidation.Valid(fullPath)
+            : DatDirectoryValidation.Invalid(
+                fullPath,
+                "The selected directory is missing required retail DAT files.",
+                missing);
+    }
+
+    private static IEnumerable<string> DefaultWindowsCandidates()
+    {
+        string userProfile = Environment.GetFolderPath(
+            Environment.SpecialFolder.UserProfile);
+        if (!string.IsNullOrWhiteSpace(userProfile))
+        {
+            yield return Path.Combine(
+                userProfile,
+                "Documents",
+                "Asheron's Call");
+        }
+
+        yield return @"C:\Turbine\Asheron's Call";
+    }
+}
+
+public sealed record DatDirectoryValidation(
+    string Directory,
+    bool IsValid,
+    string Message,
+    IReadOnlyList<string> MissingFileNames)
+{
+    internal static DatDirectoryValidation Valid(string directory) =>
+        new(
+            directory,
+            true,
+            "All four required retail DAT files were found.",
+            []);
+
+    internal static DatDirectoryValidation Invalid(
+        string directory,
+        string message,
+        IReadOnlyList<string> missingFileNames) =>
+        new(directory, false, message, missingFileNames);
+}

src/AcDream.Launcher.Core/Installation/InstallerTransactionLease.cs

@@ -0,0 +1,60 @@
+namespace AcDream.Launcher.Core.Installation;
+
+/// <summary>
+/// Cross-process ownership for every mutation or recovery of one launcher
+/// DataDirectory. The persistent lock pathname is harmless; exclusivity is
+/// owned by the open OS handle and therefore disappears if the process dies.
+/// </summary>
+internal sealed class InstallerTransactionLease : IAsyncDisposable
+{
+    internal const string LockFileName = ".install.lock";
+    private static readonly TimeSpan RetryDelay = TimeSpan.FromMilliseconds(50);
+
+    private readonly FileStream _stream;
+
+    private InstallerTransactionLease(FileStream stream)
+    {
+        _stream = stream;
+    }
+
+    internal static string GetLockPath(string dataDirectory) =>
+        Path.Combine(Path.GetFullPath(dataDirectory), LockFileName);
+
+    internal static async ValueTask<InstallerTransactionLease> AcquireAsync(
+        string dataDirectory,
+        CancellationToken cancellationToken = default)
+    {
+        string lockPath = GetLockPath(dataDirectory);
+        Directory.CreateDirectory(
+            Path.GetDirectoryName(lockPath)
+            ?? throw new InvalidOperationException(
+                "The installer lock path has no parent directory."));
+
+        while (true)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            try
+            {
+                var stream = new FileStream(
+                    lockPath,
+                    FileMode.OpenOrCreate,
+                    FileAccess.ReadWrite,
+                    FileShare.None,
+                    bufferSize: 1,
+                    FileOptions.None);
+                return new InstallerTransactionLease(stream);
+            }
+            catch (IOException)
+            {
+                await Task.Delay(RetryDelay, cancellationToken)
+                    .ConfigureAwait(false);
+            }
+        }
+    }
+
+    public ValueTask DisposeAsync()
+    {
+        _stream.Dispose();
+        return ValueTask.CompletedTask;
+    }
+}

src/AcDream.Launcher.Core/Installation/LauncherInstallRecordStore.cs

@@ -0,0 +1,488 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using AcDream.Launcher.Core.Integrity;
+using AcDream.Launcher.Core.Launching;
+using AcDream.Platform;
+
+namespace AcDream.Launcher.Core.Installation;
+
+public enum InstallRecordVerificationState
+{
+    Missing,
+    Verified,
+    Invalid,
+}
+
+public sealed record InstallRecordVerification(
+    InstallRecordVerificationState State,
+    LauncherInstallRecord? Record,
+    string Status)
+{
+    public bool IsVerified => State == InstallRecordVerificationState.Verified;
+}
+
+/// <summary>
+/// Versioned install-record persistence and startup verification. The record
+/// is atomically replaced only after a complete package has been hashed; a
+/// crash during a reinstall can recover the prior verified pak from the
+/// adjacent backup before launch is enabled.
+/// </summary>
+public sealed class LauncherInstallRecordStore
+{
+    public const uint CurrentBakeToolVersion = 4;
+
+    private static readonly JsonSerializerOptions SerializerOptions = new()
+    {
+        PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
+        WriteIndented = true,
+        UnmappedMemberHandling = JsonUnmappedMemberHandling.Disallow,
+    };
+
+    private readonly ApplicationPathSet _paths;
+    private readonly DatDirectoryLocator _datDirectories;
+    private readonly Func<string, CancellationToken, Task<string>> _computeSha256;
+
+    public LauncherInstallRecordStore(
+        ApplicationPathSet paths,
+        DatDirectoryLocator? datDirectories = null,
+        Func<string, CancellationToken, Task<string>>? computeSha256 = null)
+    {
+        _paths = paths ?? throw new ArgumentNullException(nameof(paths));
+        _datDirectories = datDirectories ?? new DatDirectoryLocator();
+        _computeSha256 = computeSha256
+            ?? ((path, cancellationToken) =>
+                FileIntegrity.ComputeSha256HexAsync(path, cancellationToken));
+    }
+
+    public string DataDirectory => Path.GetFullPath(_paths.DataDirectory);
+
+    public string RecordPath => Path.Combine(DataDirectory, "install.json");
+
+    public string PreparedAssetPath => Path.Combine(
+        DataDirectory,
+        "pak",
+        "acdream.pak");
+
+    public static string GetBackupPath(string preparedAssetPath) =>
+        preparedAssetPath + ".previous-install";
+
+    public async Task<InstallRecordVerification> LoadAndVerifyAsync(
+        CancellationToken cancellationToken = default)
+    {
+        await using InstallerTransactionLease lease =
+            await InstallerTransactionLease.AcquireAsync(
+                    DataDirectory,
+                    cancellationToken)
+                .ConfigureAwait(false);
+        return await LoadAndVerifyUnderLeaseAsync(cancellationToken)
+            .ConfigureAwait(false);
+    }
+
+    internal async Task<InstallRecordVerification> LoadAndVerifyUnderLeaseAsync(
+        CancellationToken cancellationToken = default)
+    {
+        if (!File.Exists(RecordPath))
+        {
+            return new InstallRecordVerification(
+                InstallRecordVerificationState.Missing,
+                null,
+                "Client content is not installed. Complete the first-run setup.");
+        }
+
+        LauncherInstallRecord? record;
+        try
+        {
+            await using FileStream stream = new(
+                RecordPath,
+                FileMode.Open,
+                FileAccess.Read,
+                FileShare.Read,
+                bufferSize: 4096,
+                options: FileOptions.Asynchronous | FileOptions.SequentialScan);
+            using JsonDocument document = await JsonDocument.ParseAsync(
+                    stream,
+                    cancellationToken: cancellationToken)
+                .ConfigureAwait(false);
+            JsonElement root = document.RootElement;
+            if (root.ValueKind != JsonValueKind.Object
+                || !root.TryGetProperty("version", out JsonElement version)
+                || !version.TryGetInt32(out _))
+            {
+                return Invalid(
+                    "The install record must contain an explicit integer version.");
+            }
+
+            record = root.Deserialize<LauncherInstallRecord>(SerializerOptions);
+        }
+        catch (OperationCanceledException)
+        {
+            throw;
+        }
+        catch (Exception ex) when (ex is IOException
+                                   or UnauthorizedAccessException
+                                   or JsonException
+                                   or NotSupportedException)
+        {
+            return Invalid($"The install record could not be read: {ex.Message}");
+        }
+
+        if (record is null)
+        {
+            return Invalid("The install record is empty.");
+        }
+
+        string? contractError = ValidateRecordContract(
+            record,
+            requireCanonicalSerializedPaths: true);
+        if (contractError is not null)
+        {
+            return Invalid(contractError);
+        }
+
+        string backupPath = GetBackupPath(record.PreparedAssetPath);
+        FileVerification current = await VerifyFileAsync(
+                record.PreparedAssetPath,
+                record,
+                cancellationToken)
+            .ConfigureAwait(false);
+        if (current.IsValid)
+        {
+            TryDelete(backupPath);
+            return Verified(record);
+        }
+
+        // A process crash may occur after the old verified package was moved
+        // aside but before the replacement record was published. Verify the
+        // backup against the still-current record before restoring it.
+        FileVerification backup = await VerifyFileAsync(
+                backupPath,
+                record,
+                cancellationToken)
+            .ConfigureAwait(false);
+        if (backup.IsValid)
+        {
+            try
+            {
+                Directory.CreateDirectory(
+                    Path.GetDirectoryName(record.PreparedAssetPath)
+                    ?? throw new InvalidOperationException(
+                        "The prepared asset path has no parent directory."));
+                File.Move(backupPath, record.PreparedAssetPath, overwrite: true);
+                return Verified(record, "Recovered and verified the previous client content.");
+            }
+            catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+            {
+                return Invalid(
+                    $"The previous verified package could not be restored: {ex.Message}");
+            }
+        }
+
+        return Invalid(current.Status);
+    }
+
+    public async Task SaveAtomicallyAsync(
+        LauncherInstallRecord record,
+        CancellationToken cancellationToken = default)
+    {
+        await using InstallerTransactionLease lease =
+            await InstallerTransactionLease.AcquireAsync(
+                    DataDirectory,
+                    cancellationToken)
+                .ConfigureAwait(false);
+        await SaveAtomicallyUnderLeaseAsync(record, cancellationToken)
+            .ConfigureAwait(false);
+    }
+
+    internal async Task SaveAtomicallyUnderLeaseAsync(
+        LauncherInstallRecord record,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(record);
+        LauncherInstallRecord normalized = NormalizeForSave(record);
+        string? contractError = ValidateRecordContract(
+            normalized,
+            requireCanonicalSerializedPaths: true);
+        if (contractError is not null)
+        {
+            throw new InvalidDataException(contractError);
+        }
+
+        string directory = Path.GetDirectoryName(RecordPath)
+            ?? throw new InvalidOperationException(
+                "The install record has no parent directory.");
+        Directory.CreateDirectory(directory);
+        string temporaryPath = Path.Combine(
+            directory,
+            $".{Path.GetFileName(RecordPath)}.{Guid.NewGuid():N}.tmp");
+
+        try
+        {
+            await using (FileStream stream = new(
+                temporaryPath,
+                FileMode.CreateNew,
+                FileAccess.Write,
+                FileShare.None,
+                bufferSize: 4096,
+                options: FileOptions.Asynchronous | FileOptions.WriteThrough))
+            {
+                await JsonSerializer.SerializeAsync(
+                        stream,
+                        normalized,
+                        SerializerOptions,
+                        cancellationToken)
+                    .ConfigureAwait(false);
+                await stream.FlushAsync(cancellationToken).ConfigureAwait(false);
+                stream.Flush(flushToDisk: true);
+            }
+
+            cancellationToken.ThrowIfCancellationRequested();
+            File.Move(temporaryPath, RecordPath, overwrite: true);
+        }
+        finally
+        {
+            TryDelete(temporaryPath);
+        }
+    }
+
+    private string? ValidateRecordContract(
+        LauncherInstallRecord record,
+        bool requireCanonicalSerializedPaths)
+    {
+        if (record.Version != LauncherInstallRecord.CurrentRecordVersion)
+        {
+            return $"Install record version {record.Version} is not supported.";
+        }
+
+        if (!record.HasIntegrityMetadata)
+        {
+            return "The install record is missing SHA-256, size, or bake-tool metadata.";
+        }
+
+        if (record.BakeToolVersion != CurrentBakeToolVersion)
+        {
+            return $"Bake tool version {record.BakeToolVersion} is not supported; "
+                + $"version {CurrentBakeToolVersion} is required.";
+        }
+
+        if (!IsSha256(record.PreparedAssetSha256))
+        {
+            return "The install record contains an invalid SHA-256 digest.";
+        }
+
+        if (string.IsNullOrWhiteSpace(record.PreparedAssetPath))
+        {
+            return "The prepared asset path is missing.";
+        }
+
+        if (string.IsNullOrWhiteSpace(record.DatDirectory))
+        {
+            return "The DAT directory path is missing.";
+        }
+
+        string canonicalPreparedPath = Path.GetFullPath(PreparedAssetPath);
+        if (requireCanonicalSerializedPaths
+            && !Path.IsPathFullyQualified(record.PreparedAssetPath))
+        {
+            return "The prepared asset path must be absolute.";
+        }
+
+        string recordedPreparedPath;
+        try
+        {
+            recordedPreparedPath = Path.GetFullPath(record.PreparedAssetPath);
+        }
+        catch (Exception ex) when (ex is ArgumentException
+                                   or NotSupportedException
+                                   or PathTooLongException)
+        {
+            return $"The prepared asset path is invalid: {ex.Message}";
+        }
+
+        if (!PathsEqual(recordedPreparedPath, canonicalPreparedPath))
+        {
+            return "The install record does not point to the launcher's canonical "
+                + "DataDirectory/pak/acdream.pak path.";
+        }
+
+        if (requireCanonicalSerializedPaths
+            && !CanonicalSpellingEquals(
+                record.PreparedAssetPath,
+                recordedPreparedPath,
+                trimEndingSeparator: false))
+        {
+            return "The prepared asset path is not canonical.";
+        }
+
+        if (requireCanonicalSerializedPaths
+            && !Path.IsPathFullyQualified(record.DatDirectory))
+        {
+            return "The DAT directory path must be absolute.";
+        }
+
+        DatDirectoryValidation datValidation =
+            _datDirectories.Validate(record.DatDirectory);
+        if (!datValidation.IsValid)
+        {
+            return datValidation.Message
+                + FormatMissing(datValidation.MissingFileNames);
+        }
+
+        return requireCanonicalSerializedPaths
+               && !CanonicalSpellingEquals(
+                   record.DatDirectory,
+                   datValidation.Directory,
+                   trimEndingSeparator: true)
+            ? "The DAT directory path is not canonical."
+            : null;
+    }
+
+    private LauncherInstallRecord NormalizeForSave(LauncherInstallRecord record)
+    {
+        if (record.Version != LauncherInstallRecord.CurrentRecordVersion)
+        {
+            throw new InvalidDataException(
+                $"Install record version {record.Version} is not supported.");
+        }
+
+        if (string.IsNullOrWhiteSpace(record.PreparedAssetPath))
+        {
+            throw new InvalidDataException("The prepared asset path is missing.");
+        }
+
+        DatDirectoryValidation datValidation =
+            _datDirectories.Validate(record.DatDirectory);
+        if (!datValidation.IsValid)
+        {
+            throw new InvalidDataException(
+                datValidation.Message
+                + FormatMissing(datValidation.MissingFileNames));
+        }
+
+        string recordedPreparedPath;
+        try
+        {
+            recordedPreparedPath = Path.GetFullPath(record.PreparedAssetPath);
+        }
+        catch (Exception ex) when (ex is ArgumentException
+                                   or NotSupportedException
+                                   or PathTooLongException)
+        {
+            throw new InvalidDataException(
+                $"The prepared asset path is invalid: {ex.Message}",
+                ex);
+        }
+
+        if (!PathsEqual(recordedPreparedPath, PreparedAssetPath))
+        {
+            throw new InvalidDataException(
+                "The install record does not point to the launcher's canonical "
+                + "DataDirectory/pak/acdream.pak path.");
+        }
+
+        return record with
+        {
+            Version = LauncherInstallRecord.CurrentRecordVersion,
+            DatDirectory = datValidation.Directory,
+            PreparedAssetPath = Path.GetFullPath(PreparedAssetPath),
+        };
+    }
+
+    private async Task<FileVerification> VerifyFileAsync(
+        string path,
+        LauncherInstallRecord record,
+        CancellationToken cancellationToken)
+    {
+        if (!File.Exists(path))
+        {
+            return new FileVerification(false, "The prepared package is missing.");
+        }
+
+        try
+        {
+            long length = new FileInfo(path).Length;
+            if (length != record.PreparedAssetSize)
+            {
+                return new FileVerification(
+                    false,
+                    $"The prepared package size changed (expected "
+                        + $"{record.PreparedAssetSize}, found {length}).");
+            }
+
+            string sha256 = await _computeSha256(path, cancellationToken)
+                .ConfigureAwait(false);
+            return FileIntegrity.Matches(sha256, record.PreparedAssetSha256)
+                ? new FileVerification(true, "Client content verified.")
+                : new FileVerification(
+                    false,
+                    "The prepared package SHA-256 does not match the install record.");
+        }
+        catch (OperationCanceledException)
+        {
+            throw;
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            return new FileVerification(
+                false,
+                $"The prepared package could not be verified: {ex.Message}");
+        }
+    }
+
+    private static InstallRecordVerification Verified(
+        LauncherInstallRecord record,
+        string status = "Client content SHA-256, size, and bake-tool version verified.") =>
+        new(InstallRecordVerificationState.Verified, record, status);
+
+    private static InstallRecordVerification Invalid(string status) =>
+        new(InstallRecordVerificationState.Invalid, null, status);
+
+    private static bool IsSha256(string value) =>
+        value.Length == 64 && value.All(Uri.IsHexDigit);
+
+    private static string FormatMissing(IReadOnlyList<string> missing) =>
+        missing.Count == 0
+            ? string.Empty
+            : " Missing: " + string.Join(", ", missing) + ".";
+
+    private static bool PathsEqual(string left, string right) =>
+        string.Equals(
+            Path.TrimEndingDirectorySeparator(left),
+            Path.TrimEndingDirectorySeparator(right),
+            OperatingSystem.IsWindows()
+                ? StringComparison.OrdinalIgnoreCase
+                : StringComparison.Ordinal);
+
+    private static bool CanonicalSpellingEquals(
+        string serialized,
+        string canonical,
+        bool trimEndingSeparator)
+    {
+        string candidate = trimEndingSeparator
+            ? Path.TrimEndingDirectorySeparator(serialized)
+            : serialized;
+        return string.Equals(
+            candidate,
+            canonical,
+            OperatingSystem.IsWindows()
+                ? StringComparison.OrdinalIgnoreCase
+                : StringComparison.Ordinal);
+    }
+
+    internal static void TryDelete(string path)
+    {
+        try
+        {
+            if (File.Exists(path))
+            {
+                File.Delete(path);
+            }
+        }
+        catch
+        {
+            // A stale temp/backup is never treated as a published record. The
+            // next startup verification retries cleanup/recovery.
+        }
+    }
+
+    private sealed record FileVerification(bool IsValid, string Status);
+}

src/AcDream.Launcher.Core/Installation/LauncherInstaller.cs

@@ -0,0 +1,561 @@
+using AcDream.Launcher.Core.Integrity;
+using AcDream.Launcher.Core.Launching;
+using AcDream.Platform;
+
+namespace AcDream.Launcher.Core.Installation;
+
+public enum LauncherInstallPhase
+{
+    Idle,
+    ValidatingDatFiles,
+    PreparingOutput,
+    BakingMeshes,
+    BakingCollision,
+    VerifyingPackage,
+    SavingRecord,
+    Completed,
+    Cancelled,
+    Failed,
+}
+
+public sealed record LauncherInstallProgress(
+    LauncherInstallPhase Phase,
+    string Status,
+    long Completed = 0,
+    long Total = 0,
+    int Failures = 0,
+    double EtaSeconds = 0)
+{
+    public double Fraction => Total > 0
+        ? Math.Clamp((double)Completed / Total, 0, 1)
+        : 0;
+}
+
+public sealed record LauncherInstallResult(LauncherInstallRecord Record);
+
+public sealed class LauncherInstallException : Exception
+{
+    public LauncherInstallException(string message)
+        : base(message)
+    {
+    }
+
+    public LauncherInstallException(string message, Exception innerException)
+        : base(message, innerException)
+    {
+    }
+}
+
+public interface ILauncherInstaller
+{
+    IReadOnlyList<DatDirectoryValidation> DetectDatDirectories();
+
+    DatDirectoryValidation ValidateDatDirectory(string? directory);
+
+    Task<InstallRecordVerification> LoadExistingAsync(
+        CancellationToken cancellationToken = default);
+
+    Task<LauncherInstallResult> InstallAsync(
+        string datDirectory,
+        int threads,
+        IProgress<LauncherInstallProgress>? progress = null,
+        CancellationToken cancellationToken = default);
+}
+
+/// <summary>
+/// BCL-only first-run transaction. It invokes the GL-free bake executable as
+/// a child, consumes only its versioned JSONL records, verifies the published
+/// pak, and atomically records the install. A prior verified package is moved
+/// to an adjacent recovery slot and restored on every failure/cancellation
+/// path, so a fake or crashed child cannot replace it with partial output.
+/// </summary>
+public sealed class LauncherInstaller : ILauncherInstaller
+{
+    private readonly string _bakeExecutablePath;
+    private readonly DatDirectoryLocator _datDirectories;
+    private readonly LauncherInstallRecordStore _recordStore;
+    private readonly IBakeProcessRunner _processRunner;
+    private readonly Func<string, CancellationToken, Task<string>> _computeSha256;
+    private readonly SemaphoreSlim _installGate = new(1, 1);
+
+    private LauncherInstallRecord? _verifiedRecord;
+
+    public LauncherInstaller(
+        ApplicationPathSet paths,
+        string bakeExecutablePath,
+        DatDirectoryLocator? datDirectories = null,
+        LauncherInstallRecordStore? recordStore = null,
+        IBakeProcessRunner? processRunner = null,
+        Func<string, CancellationToken, Task<string>>? computeSha256 = null)
+    {
+        ArgumentNullException.ThrowIfNull(paths);
+        ArgumentException.ThrowIfNullOrWhiteSpace(bakeExecutablePath);
+        _bakeExecutablePath = Path.GetFullPath(bakeExecutablePath);
+        _datDirectories = datDirectories ?? new DatDirectoryLocator();
+        _computeSha256 = computeSha256
+            ?? ((path, cancellationToken) =>
+                FileIntegrity.ComputeSha256HexAsync(path, cancellationToken));
+        _recordStore = recordStore
+            ?? new LauncherInstallRecordStore(
+                paths,
+                _datDirectories,
+                _computeSha256);
+        _processRunner = processRunner ?? new SystemBakeProcessRunner();
+    }
+
+    public IReadOnlyList<DatDirectoryValidation> DetectDatDirectories() =>
+        _datDirectories.Detect();
+
+    public DatDirectoryValidation ValidateDatDirectory(string? directory) =>
+        _datDirectories.Validate(directory);
+
+    public async Task<InstallRecordVerification> LoadExistingAsync(
+        CancellationToken cancellationToken = default)
+    {
+        await _installGate.WaitAsync(cancellationToken).ConfigureAwait(false);
+        try
+        {
+            await using InstallerTransactionLease lease =
+                await InstallerTransactionLease.AcquireAsync(
+                        _recordStore.DataDirectory,
+                        cancellationToken)
+                    .ConfigureAwait(false);
+            InstallRecordVerification verification =
+                await RecoverExistingUnderPublicationGuardAsync(
+                        cancellationToken)
+                .ConfigureAwait(false);
+            _verifiedRecord = verification.Record;
+            return verification;
+        }
+        finally
+        {
+            _installGate.Release();
+        }
+    }
+
+    public async Task<LauncherInstallResult> InstallAsync(
+        string datDirectory,
+        int threads,
+        IProgress<LauncherInstallProgress>? progress = null,
+        CancellationToken cancellationToken = default)
+    {
+        if (threads <= 0)
+        {
+            throw new ArgumentOutOfRangeException(
+                nameof(threads),
+                "Bake thread count must be positive.");
+        }
+
+        await _installGate.WaitAsync(cancellationToken).ConfigureAwait(false);
+        try
+        {
+            await using InstallerTransactionLease lease =
+                await InstallerTransactionLease.AcquireAsync(
+                        _recordStore.DataDirectory,
+                        cancellationToken)
+                    .ConfigureAwait(false);
+            return await InstallCoreAsync(
+                    datDirectory,
+                    threads,
+                    progress,
+                    cancellationToken)
+                .ConfigureAwait(false);
+        }
+        finally
+        {
+            _installGate.Release();
+        }
+    }
+
+    private async Task<LauncherInstallResult> InstallCoreAsync(
+        string datDirectory,
+        int threads,
+        IProgress<LauncherInstallProgress>? progress,
+        CancellationToken cancellationToken)
+    {
+        Report(
+            progress,
+            LauncherInstallPhase.ValidatingDatFiles,
+            "Validating the four retail DAT files...");
+        DatDirectoryValidation validation = _datDirectories.Validate(datDirectory);
+        if (!validation.IsValid)
+        {
+            string message = validation.Message
+                + FormatMissing(validation.MissingFileNames);
+            Report(progress, LauncherInstallPhase.Failed, message);
+            throw new LauncherInstallException(message);
+        }
+
+        if (!File.Exists(_bakeExecutablePath))
+        {
+            string message =
+                $"The co-deployed bake tool is missing at '{_bakeExecutablePath}'.";
+            Report(progress, LauncherInstallPhase.Failed, message);
+            throw new LauncherInstallException(message);
+        }
+
+        string outputPath = _recordStore.PreparedAssetPath;
+        string backupPath = LauncherInstallRecordStore.GetBackupPath(outputPath);
+        InstallRecordVerification existing =
+            await RecoverExistingUnderPublicationGuardAsync(cancellationToken)
+            .ConfigureAwait(false);
+        _verifiedRecord = existing.Record;
+
+        Directory.CreateDirectory(
+            Path.GetDirectoryName(outputPath)
+            ?? throw new InvalidOperationException(
+                "The prepared package path has no parent directory."));
+
+        Report(
+            progress,
+            LauncherInstallPhase.PreparingOutput,
+            "Preparing the atomic package transaction...");
+        bool previousPreserved = PreservePreviousPackage(outputPath, backupPath);
+        if (!previousPreserved)
+        {
+            LauncherInstallRecordStore.TryDelete(backupPath);
+        }
+
+        var parser = new BakeProgressJsonlParser();
+        var protocol = new BakeProgressProtocol();
+        string? publicationNonce = null;
+
+        void Observe(BakeProgressEvent progressEvent)
+        {
+            bool accepted = protocol.Observe(progressEvent);
+            switch (progressEvent)
+            {
+                case BakeWorkProgressEvent value when accepted:
+                    LauncherInstallPhase phase = value.Phase switch
+                    {
+                        "mesh" => LauncherInstallPhase.BakingMeshes,
+                        "collision" => LauncherInstallPhase.BakingCollision,
+                        _ => LauncherInstallPhase.BakingMeshes,
+                    };
+                    Report(
+                        progress,
+                        phase,
+                        $"Baking {value.Phase} assets: "
+                            + $"{value.Completed:N0}/{value.Total:N0}; "
+                            + $"failures: {value.Failures:N0}",
+                        value.Completed,
+                        value.Total,
+                        value.Failures,
+                        value.EtaSeconds);
+                    break;
+                case BakeErrorEvent value when accepted:
+                    Report(
+                        progress,
+                        LauncherInstallPhase.Failed,
+                        $"Bake tool error: {value.Message}");
+                    break;
+                case MalformedBakeProgressEvent value:
+                    Report(
+                        progress,
+                        LauncherInstallPhase.Failed,
+                        $"Malformed bake progress: {value.Reason}");
+                    break;
+                // Human lines are deliberately ignored, and unknown event
+                // kinds are forward-compatible. A future protocol version
+                // cannot satisfy the required v1 started/completed pair.
+            }
+        }
+
+        try
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            publicationNonce = BakePublicationGuardPaths.CreateNonce();
+            await using (
+                BakePublicationGuardContract.PublicationLease publication =
+                    await BakePublicationGuardContract.AcquireAsync(
+                            outputPath,
+                            cancellationToken)
+                        .ConfigureAwait(false))
+            {
+                BakePublicationGuardContract.Authorize(
+                    outputPath,
+                    publicationNonce,
+                    publication);
+            }
+
+            var request = new BakeProcessRequest(
+                _bakeExecutablePath,
+                validation.Directory,
+                outputPath,
+                threads,
+                publicationNonce);
+            BakeProcessResult processResult = await _processRunner.RunAsync(
+                    request,
+                    chunk =>
+                    {
+                        foreach (BakeProgressEvent progressEvent in parser.Append(chunk))
+                        {
+                            Observe(progressEvent);
+                        }
+                    },
+                    cancellationToken)
+                .ConfigureAwait(false);
+
+            foreach (BakeProgressEvent progressEvent in parser.Complete())
+            {
+                Observe(progressEvent);
+            }
+            protocol.CompleteInput();
+
+            cancellationToken.ThrowIfCancellationRequested();
+            if (protocol.Violation is not null)
+            {
+                throw new LauncherInstallException(protocol.Violation);
+            }
+
+            if (processResult.ExitCode != 0)
+            {
+                throw new LauncherInstallException(
+                    BuildChildFailure(
+                        processResult.ExitCode,
+                        protocol.Error?.Message,
+                        processResult.StandardError));
+            }
+
+            if (protocol.Error is not null)
+            {
+                throw new LauncherInstallException(
+                    $"The bake tool reported an error: {protocol.Error.Message}");
+            }
+
+            BakeStartedEvent? started = protocol.Started;
+            BakeCompletedEvent? completed = protocol.Completed;
+            if (started is null || completed is null)
+            {
+                throw new LauncherInstallException(
+                    "The bake protocol did not finish with a v1 completed event.");
+            }
+
+            if (started.BakeToolVersion != completed.BakeToolVersion
+                || completed.BakeToolVersion
+                    != LauncherInstallRecordStore.CurrentBakeToolVersion)
+            {
+                throw new LauncherInstallException(
+                    $"The bake tool reported version {completed.BakeToolVersion}; "
+                    + $"version {LauncherInstallRecordStore.CurrentBakeToolVersion} "
+                    + "is required.");
+            }
+
+            if (completed.Failures != 0)
+            {
+                throw new LauncherInstallException(
+                    $"The bake completed with {completed.Failures:N0} failed assets.");
+            }
+
+            if (!File.Exists(outputPath))
+            {
+                throw new LauncherInstallException(
+                    "The bake tool reported success but did not publish acdream.pak.");
+            }
+
+            long size = new FileInfo(outputPath).Length;
+            if (size <= 0 || size != completed.OutputBytes)
+            {
+                throw new LauncherInstallException(
+                    "The published package size does not match the bake completion record.");
+            }
+
+            Report(
+                progress,
+                LauncherInstallPhase.VerifyingPackage,
+                "Computing the prepared package SHA-256...");
+            string sha256 = await _computeSha256(outputPath, cancellationToken)
+                .ConfigureAwait(false);
+            cancellationToken.ThrowIfCancellationRequested();
+
+            var record = new LauncherInstallRecord(
+                validation.Directory,
+                outputPath,
+                sha256,
+                size,
+                completed.BakeToolVersion);
+            Report(
+                progress,
+                LauncherInstallPhase.SavingRecord,
+                "Saving the verified install record...");
+            await _recordStore.SaveAtomicallyUnderLeaseAsync(
+                    record,
+                    cancellationToken)
+                .ConfigureAwait(false);
+
+            _verifiedRecord = record;
+            await FinalizeSuccessfulPublicationAsync(
+                    outputPath,
+                    backupPath,
+                    publicationNonce)
+                .ConfigureAwait(false);
+            Report(
+                progress,
+                LauncherInstallPhase.Completed,
+                "Client content installed and verified.",
+                completed: 1,
+                total: 1);
+            return new LauncherInstallResult(record);
+        }
+        catch (OperationCanceledException)
+        {
+            await FinalizeFailedPublicationAsync(
+                    outputPath,
+                    backupPath,
+                    previousPreserved,
+                    publicationNonce)
+                .ConfigureAwait(false);
+            Report(
+                progress,
+                LauncherInstallPhase.Cancelled,
+                "Installation cancelled; no new install record was published.");
+            throw;
+        }
+        catch (Exception ex)
+        {
+            await FinalizeFailedPublicationAsync(
+                    outputPath,
+                    backupPath,
+                    previousPreserved,
+                    publicationNonce)
+                .ConfigureAwait(false);
+            Report(
+                progress,
+                LauncherInstallPhase.Failed,
+                $"Installation failed: {ex.Message}");
+            if (ex is LauncherInstallException)
+            {
+                throw;
+            }
+
+            throw new LauncherInstallException("Installation failed.", ex);
+        }
+    }
+
+    private async Task<InstallRecordVerification>
+        RecoverExistingUnderPublicationGuardAsync(
+            CancellationToken cancellationToken)
+    {
+        string outputPath = _recordStore.PreparedAssetPath;
+        await using BakePublicationGuardContract.PublicationLease publication =
+            await BakePublicationGuardContract.AcquireAsync(
+                    outputPath,
+                    cancellationToken)
+                .ConfigureAwait(false);
+        // Any child whose parent died before it acquired this lock is now
+        // irrevocably stale. A child already holding the lock must finish its
+        // promotion before recovery reaches this invalidation point.
+        BakePublicationGuardContract.Invalidate(outputPath, publication);
+        BakeOutputStagingContract.DeleteOwnedStagingFiles(outputPath);
+        return await _recordStore.LoadAndVerifyUnderLeaseAsync(cancellationToken)
+            .ConfigureAwait(false);
+    }
+
+    private static async Task FinalizeSuccessfulPublicationAsync(
+        string outputPath,
+        string backupPath,
+        string publicationNonce)
+    {
+        await using BakePublicationGuardContract.PublicationLease publication =
+            await BakePublicationGuardContract.AcquireAsync(
+                    outputPath,
+                    CancellationToken.None)
+                .ConfigureAwait(false);
+        BakePublicationGuardContract.Invalidate(
+            outputPath,
+            publication,
+            publicationNonce);
+        LauncherInstallRecordStore.TryDelete(backupPath);
+        BakeOutputStagingContract.DeleteOwnedStagingFiles(outputPath);
+    }
+
+    private static async Task FinalizeFailedPublicationAsync(
+        string outputPath,
+        string backupPath,
+        bool previousPreserved,
+        string? publicationNonce)
+    {
+        await using BakePublicationGuardContract.PublicationLease publication =
+            await BakePublicationGuardContract.AcquireAsync(
+                    outputPath,
+                    CancellationToken.None)
+                .ConfigureAwait(false);
+        BakePublicationGuardContract.Invalidate(
+            outputPath,
+            publication,
+            publicationNonce);
+        RestorePreviousPackage(outputPath, backupPath, previousPreserved);
+        BakeOutputStagingContract.DeleteOwnedStagingFiles(outputPath);
+    }
+
+    private bool PreservePreviousPackage(string outputPath, string backupPath)
+    {
+        LauncherInstallRecord? previous = _verifiedRecord;
+        if (previous is null
+            || !PathsEqual(previous.PreparedAssetPath, outputPath)
+            || !File.Exists(outputPath))
+        {
+            return false;
+        }
+
+        File.Move(outputPath, backupPath, overwrite: true);
+        return true;
+    }
+
+    private static void RestorePreviousPackage(
+        string outputPath,
+        string backupPath,
+        bool previousPreserved)
+    {
+        if (previousPreserved && File.Exists(backupPath))
+        {
+            File.Move(backupPath, outputPath, overwrite: true);
+            return;
+        }
+
+        LauncherInstallRecordStore.TryDelete(outputPath);
+        LauncherInstallRecordStore.TryDelete(backupPath);
+    }
+
+    private static string BuildChildFailure(
+        int exitCode,
+        string? jsonError,
+        string standardError)
+    {
+        string detail = !string.IsNullOrWhiteSpace(jsonError)
+            ? jsonError
+            : standardError.Trim();
+        return detail.Length == 0
+            ? $"The bake tool exited with code {exitCode}."
+            : $"The bake tool exited with code {exitCode}: {detail}";
+    }
+
+    private static void Report(
+        IProgress<LauncherInstallProgress>? progress,
+        LauncherInstallPhase phase,
+        string status,
+        long completed = 0,
+        long total = 0,
+        int failures = 0,
+        double etaSeconds = 0) =>
+        progress?.Report(new LauncherInstallProgress(
+            phase,
+            status,
+            completed,
+            total,
+            failures,
+            etaSeconds));
+
+    private static string FormatMissing(IReadOnlyList<string> missing) =>
+        missing.Count == 0
+            ? string.Empty
+            : " Missing: " + string.Join(", ", missing) + ".";
+
+    private static bool PathsEqual(string left, string right) =>
+        string.Equals(
+            Path.GetFullPath(left),
+            Path.GetFullPath(right),
+            OperatingSystem.IsWindows()
+                ? StringComparison.OrdinalIgnoreCase
+                : StringComparison.Ordinal);
+}

src/AcDream.Launcher.Core/Integrity/FileIntegrity.cs

@@ -27,6 +27,11 @@ public static class FileIntegrity
         return Convert.ToHexStringLower(hash);
     }
 
+    /// <summary>
+    /// Asynchronous, cancellable counterpart used while verifying a multi-
+    /// gigabyte prepared package. The file stays streamed and no buffer is
+    /// retained after the hash completes.
+    /// </summary>
     public static async Task<string> ComputeSha256HexAsync(
         string filePath,
         CancellationToken cancellationToken = default)
@@ -38,8 +43,8 @@ public static class FileIntegrity
             FileMode.Open,
             FileAccess.Read,
             FileShare.Read,
-            bufferSize: 4096,
-            useAsync: true);
+            bufferSize: 1024 * 1024,
+            options: FileOptions.Asynchronous | FileOptions.SequentialScan);
         byte[] hash = await SHA256.HashDataAsync(stream, cancellationToken)
             .ConfigureAwait(false);
         return Convert.ToHexStringLower(hash);

src/AcDream.Launcher.Core/Launching/LauncherInstallRecord.cs

@@ -3,10 +3,24 @@ namespace AcDream.Launcher.Core.Launching;
 /// <summary>
 /// The DAT/pak locations a completed install (LA9) records and every
 /// session-config composition consumes for
-/// <see cref="SessionContentDescriptor"/>. SHA-256/version bookkeeping
-/// for the install record itself is LA9/LA10 scope; this slice only
-/// needs the two paths a session config requires.
+/// <see cref="SessionContentDescriptor"/>. Integrity metadata is launcher-
+/// local: it is verified before this record is admitted to the orchestrator
+/// and is deliberately not copied into the host session-config contract.
 /// </summary>
 public sealed record LauncherInstallRecord(
     string DatDirectory,
-    string PreparedAssetPath);
+    string PreparedAssetPath,
+    string PreparedAssetSha256 = "",
+    long PreparedAssetSize = 0,
+    uint BakeToolVersion = 0)
+{
+    public const int CurrentRecordVersion = 1;
+
+    public int Version { get; init; } = CurrentRecordVersion;
+
+    public bool HasIntegrityMetadata =>
+        !string.IsNullOrEmpty(PreparedAssetSha256)
+        && PreparedAssetSha256.Length == 64
+        && PreparedAssetSize > 0
+        && BakeToolVersion > 0;
+}

src/AcDream.Launcher.Core/Orchestration/LauncherOrchestrator.cs

@@ -29,6 +29,7 @@ public sealed class LauncherOrchestrator : ILauncherOrchestrator
     private readonly List<ManagedActivity> _activities = [];
 
     private LauncherInstallRecord? _installRecord;
+    private string _installationStatus;
     private bool _disposed;
 
     public LauncherOrchestrator(
@@ -40,7 +41,8 @@ public sealed class LauncherOrchestrator : ILauncherOrchestrator
         ILauncherSessionConfigService? configService = null,
         ILauncherProcessSupervisorFactory? supervisorFactory = null,
         IStatusEventSourceFactory? statusSourceFactory = null,
-        Func<string>? sessionIdFactory = null)
+        Func<string>? sessionIdFactory = null,
+        string? installationStatus = null)
     {
         _profileStore = profileStore ?? throw new ArgumentNullException(nameof(profileStore));
         _paths = paths ?? throw new ArgumentNullException(nameof(paths));
@@ -51,6 +53,10 @@ public sealed class LauncherOrchestrator : ILauncherOrchestrator
         _supervisorFactory = supervisorFactory ?? new LauncherProcessSupervisorFactory();
         _statusSourceFactory = statusSourceFactory ?? new StatusFileTailerFactory();
         _sessionIdFactory = sessionIdFactory ?? CreateSessionId;
+        _installationStatus = installationStatus
+            ?? (installRecord is null
+                ? FirstRunRequired
+                : "Client content paths are configured.");
     }
 
     public event EventHandler? StateChanged;
@@ -85,9 +91,7 @@ public sealed class LauncherOrchestrator : ILauncherOrchestrator
                 sessions,
                 _platform,
                 _installRecord is not null,
-                _installRecord is null
-                    ? FirstRunRequired
-                    : "Client content paths are configured.");
+                _installationStatus);
         }
     }
 
@@ -184,6 +188,9 @@ public sealed class LauncherOrchestrator : ILauncherOrchestrator
         {
             ThrowIfDisposed();
             _installRecord = installRecord;
+            _installationStatus = installRecord is null
+                ? FirstRunRequired
+                : "Client content SHA-256, size, and bake-tool version verified.";
         }
 
         RaiseStateChanged();

src/AcDream.Launcher/AcDream.Launcher.csproj

@@ -10,7 +10,8 @@
     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <PublishSingleFile>true</PublishSingleFile>
     <IncludeNativeLibrariesForSelfExtract>true</IncludeNativeLibrariesForSelfExtract>
-    <SelfContained Condition="'$(RuntimeIdentifier)' == 'linux-x64'">true</SelfContained>
+    <SelfContained Condition="'$(RuntimeIdentifier)' != ''">true</SelfContained>
+    <PublishBakeTool Condition="'$(PublishBakeTool)' == ''">true</PublishBakeTool>
   </PropertyGroup>
 
   <ItemGroup>
@@ -22,4 +23,20 @@
   <ItemGroup>
     <ProjectReference Include="..\AcDream.Launcher.Core\AcDream.Launcher.Core.csproj" />
   </ItemGroup>
+
+  <!-- Distribution composition only: do not add a Launcher -> Bake project
+       reference. A per-RID launcher publish explicitly publishes the GL-free
+       CLI as its own self-contained single file into the same directory. -->
+  <Target Name="PublishCoDeployedBakeTool"
+          AfterTargets="Publish"
+          Condition="'$(RuntimeIdentifier)' != '' and '$(PublishBakeTool)' == 'true'">
+    <PropertyGroup>
+      <_BakePublishDirectory Condition="$([System.IO.Path]::IsPathRooted('$(PublishDir)'))">$(PublishDir)</_BakePublishDirectory>
+      <_BakePublishDirectory Condition="'$(_BakePublishDirectory)' == ''">$(MSBuildProjectDirectory)\$(PublishDir)</_BakePublishDirectory>
+    </PropertyGroup>
+    <MSBuild Projects="$(MSBuildProjectDirectory)\..\AcDream.Bake\AcDream.Bake.csproj"
+             Targets="Restore;Publish"
+             BuildInParallel="false"
+             Properties="Configuration=$(Configuration);RuntimeIdentifier=$(RuntimeIdentifier);SelfContained=true;PublishSingleFile=true;IncludeNativeLibrariesForSelfExtract=true;EnableSingleFileAnalyzer=false;PublishDir=$(_BakePublishDirectory);PublishBakeTool=false" />
+  </Target>
 </Project>

src/AcDream.Launcher/App.axaml.cs

@@ -1,3 +1,4 @@
+using AcDream.Launcher.Core.Installation;
 using AcDream.Launcher.Core.Launching;
 using AcDream.Launcher.Core.Orchestration;
 using AcDream.Launcher.Core.Profiles;
@@ -22,15 +23,40 @@ public sealed partial class App : Application
         {
             ApplicationPathSet paths = ApplicationPathSet.Resolve();
             LauncherProfileStore profiles = LauncherProfileStore.ForApplicationPaths(paths);
-            LauncherInstallRecord? install = ResolveDevelopmentInstallRecord();
+            string executableSuffix = OperatingSystem.IsWindows() ? ".exe" : string.Empty;
+            var installer = new LauncherInstaller(
+                paths,
+                Path.Combine(
+                    AppContext.BaseDirectory,
+                    "acdream-bake" + executableSuffix));
+            InstallRecordVerification verification;
+            try
+            {
+                // Hashing the package before constructing the orchestrator is
+                // intentional: no launch action is enabled until the persisted
+                // size/SHA/tool-version record has been verified.
+                verification = installer.LoadExistingAsync()
+                    .GetAwaiter()
+                    .GetResult();
+            }
+            catch (Exception ex)
+            {
+                verification = new InstallRecordVerification(
+                    InstallRecordVerificationState.Invalid,
+                    null,
+                    $"Client content verification failed: {ex.Message}");
+            }
+
             _orchestrator = new LauncherOrchestrator(
                 profiles,
                 paths,
                 LauncherExecutableSet.FromDirectory(AppContext.BaseDirectory),
-                install);
+                verification.Record,
+                installationStatus: verification.Status);
             _viewModel = new LauncherWindowViewModel(
                 _orchestrator,
-                new AvaloniaUiDispatcher());
+                new AvaloniaUiDispatcher(),
+                installer);
             _viewModel.Initialize();
 
             desktop.MainWindow = new MainWindow
@@ -43,19 +69,6 @@ public sealed partial class App : Application
         base.OnFrameworkInitializationCompleted();
     }
 
-    private static LauncherInstallRecord? ResolveDevelopmentInstallRecord()
-    {
-        // LA9 owns persisted install discovery. LA4 accepts the existing
-        // developer environment pair at this one composition root so the
-        // launch/probe UI can be exercised before the first-run body lands.
-        string? datDirectory = Environment.GetEnvironmentVariable("ACDREAM_DAT_DIR");
-        string? preparedAssetPath = Environment.GetEnvironmentVariable("ACDREAM_PAK_PATH");
-        return !string.IsNullOrWhiteSpace(datDirectory)
-            && !string.IsNullOrWhiteSpace(preparedAssetPath)
-            ? new LauncherInstallRecord(datDirectory, preparedAssetPath)
-            : null;
-    }
-
     private void OnDesktopExit(object? sender, ControlledApplicationLifetimeExitEventArgs e)
     {
         _viewModel?.Dispose();

src/AcDream.Launcher/MainWindow.axaml

@@ -342,21 +342,88 @@
             KeyDown="OnModalKeyDown"
             AutomationProperties.Name="First-run setup modal dialog"
             IsVisible="{Binding FirstRunWizardShell.IsOpen}">
-      <Border Classes="card" Width="560" HorizontalAlignment="Center" VerticalAlignment="Center">
-        <StackPanel Spacing="12">
-          <TextBlock Text="{Binding FirstRunWizardShell.Title}" FontSize="24" FontWeight="Bold" />
-          <TextBlock Text="{Binding FirstRunWizardShell.Body}" TextWrapping="Wrap" />
-          <Border Background="#24344B" Padding="10" CornerRadius="5">
-            <TextBlock Text="{Binding FirstRunWizardShell.Status}" TextWrapping="Wrap" />
-          </Border>
-          <Button x:Name="FirstRunCloseButton"
-                  Content="Close"
-                  HorizontalAlignment="Right"
-                  IsCancel="True"
-                  IsDefault="True"
-                  AutomationProperties.Name="Close first-run setup"
-                  Command="{Binding FirstRunWizardShell.CloseCommand}" />
-        </StackPanel>
+      <Border Classes="card"
+              Width="680"
+              MaxHeight="680"
+              HorizontalAlignment="Center"
+              VerticalAlignment="Center">
+        <ScrollViewer>
+          <StackPanel Spacing="12">
+            <TextBlock Text="{Binding FirstRunWizardShell.Title}" FontSize="24" FontWeight="Bold" />
+            <TextBlock Text="{Binding FirstRunWizardShell.Body}" TextWrapping="Wrap" />
+
+            <TextBlock Text="Retail DAT directory" FontWeight="SemiBold" />
+            <Grid ColumnDefinitions="*,Auto" ColumnSpacing="8">
+              <TextBox x:Name="FirstRunDatDirectoryTextBox"
+                       AutomationProperties.Name="Retail DAT directory"
+                       IsEnabled="{Binding FirstRunWizardShell.CanEditInputs}"
+                       PlaceholderText="Path containing client_portal.dat"
+                       Text="{Binding FirstRunWizardShell.DatDirectory, Mode=TwoWay}" />
+              <Button Grid.Column="1"
+                      Content="Browse..."
+                      AutomationProperties.Name="Browse for retail DAT directory"
+                      IsEnabled="{Binding FirstRunWizardShell.CanEditInputs}"
+                      Click="OnBrowseDatDirectory" />
+            </Grid>
+            <StackPanel Spacing="3">
+              <TextBlock Text="{Binding FirstRunWizardShell.ValidationStatus}"
+                         TextWrapping="Wrap" />
+              <TextBlock Text="{Binding FirstRunWizardShell.MissingFiles}"
+                         Foreground="#FFB0A0"
+                         IsVisible="{Binding FirstRunWizardShell.HasMissingFiles}"
+                         TextWrapping="Wrap" />
+            </StackPanel>
+
+            <Grid ColumnDefinitions="160,*" ColumnSpacing="10">
+              <StackPanel Spacing="4">
+                <TextBlock Text="Bake worker threads" FontWeight="SemiBold" />
+                <TextBox AutomationProperties.Name="Bake worker threads"
+                         IsEnabled="{Binding FirstRunWizardShell.CanEditInputs}"
+                         Text="{Binding FirstRunWizardShell.ThreadsText, Mode=TwoWay}" />
+              </StackPanel>
+              <TextBlock Grid.Column="1"
+                         VerticalAlignment="Bottom"
+                         Classes="muted"
+                         Text="{Binding FirstRunWizardShell.ThreadCountValidation}"
+                         TextWrapping="Wrap" />
+            </Grid>
+
+            <Border Background="#24344B" Padding="10" CornerRadius="5">
+              <StackPanel Spacing="7">
+                <TextBlock Text="{Binding FirstRunWizardShell.Status}" TextWrapping="Wrap" />
+                <ProgressBar Minimum="0"
+                             Maximum="100"
+                             Value="{Binding FirstRunWizardShell.ProgressPercent}"
+                             IsIndeterminate="{Binding FirstRunWizardShell.IsProgressIndeterminate}" />
+                <TextBlock Text="{Binding FirstRunWizardShell.Phase}"
+                           Classes="muted" />
+              </StackPanel>
+            </Border>
+
+            <TextBlock Text="{Binding FirstRunWizardShell.Error}"
+                       Foreground="#FF9A9A"
+                       IsVisible="{Binding FirstRunWizardShell.HasError}"
+                       TextWrapping="Wrap" />
+            <StackPanel Orientation="Horizontal" HorizontalAlignment="Right" Spacing="8">
+              <Button Content="Validate"
+                      AutomationProperties.Name="Validate retail DAT directory"
+                      Command="{Binding FirstRunWizardShell.ValidateCommand}" />
+              <Button Content="Cancel bake"
+                      AutomationProperties.Name="Cancel first-run bake"
+                      Command="{Binding FirstRunWizardShell.CancelCommand}" />
+              <Button x:Name="FirstRunCloseButton"
+                      Content="Close"
+                      IsCancel="True"
+                      AutomationProperties.Name="Close first-run setup"
+                      Command="{Binding FirstRunWizardShell.CloseCommand}" />
+              <Button Content="Build and install"
+                      Classes="primary"
+                      IsDefault="True"
+                      AutomationProperties.Name="Build and install client content"
+                      Command="{Binding FirstRunWizardShell.StartCommand}" />
+            </StackPanel>
+          </StackPanel>
+        </ScrollViewer>
       </Border>
     </Border>
 

src/AcDream.Launcher/MainWindow.axaml.cs

@@ -2,7 +2,9 @@ using System.ComponentModel;
 using AcDream.Launcher.ViewModels;
 using Avalonia.Controls;
 using Avalonia.Input;
+using Avalonia.Interactivity;
 using Avalonia.Markup.Xaml;
+using Avalonia.Platform.Storage;
 using Avalonia.Threading;
 
 namespace AcDream.Launcher;
@@ -116,7 +118,7 @@ public sealed partial class MainWindow : Window
         }
         else if (viewModel.FirstRunWizardShell.IsOpen)
         {
-            FirstRunCloseButton.Focus();
+            FirstRunDatDirectoryTextBox.Focus();
         }
         else if (viewModel.UpdatePromptShell.IsOpen)
         {
@@ -134,4 +136,33 @@ public sealed partial class MainWindow : Window
         viewModel.CloseActiveModal();
         e.Handled = true;
     }
+
+    private async void OnBrowseDatDirectory(object? sender, RoutedEventArgs e)
+    {
+        if (DataContext is not LauncherWindowViewModel viewModel)
+        {
+            return;
+        }
+
+        try
+        {
+            IReadOnlyList<IStorageFolder> folders = await StorageProvider
+                .OpenFolderPickerAsync(new FolderPickerOpenOptions
+                {
+                    Title = "Choose the retail Asheron's Call DAT directory",
+                    AllowMultiple = false,
+                });
+            if (folders.Count > 0)
+            {
+                viewModel.FirstRunWizardShell.SelectDatDirectory(
+                    folders[0].Path.LocalPath);
+            }
+        }
+        catch (Exception ex)
+        {
+            viewModel.FirstRunWizardShell.ReportPickerError(ex.Message);
+        }
+
+        e.Handled = true;
+    }
 }

src/AcDream.Launcher/ViewModels/FirstRunInstallerViewModel.cs

@@ -0,0 +1,384 @@
+using System.ComponentModel;
+using AcDream.Launcher.Core.Installation;
+using AcDream.Launcher.Core.Launching;
+
+namespace AcDream.Launcher.ViewModels;
+
+/// <summary>
+/// Thin wizard projection over the BCL-only installer transaction. Filesystem,
+/// child-process, hashing, recovery, and record publication all remain in
+/// Launcher.Core; this type owns only editable fields and UI command state.
+/// </summary>
+public sealed class FirstRunInstallerViewModel : ObservableObject, IDisposable
+{
+    private readonly ILauncherInstaller _installer;
+    private readonly IUiDispatcher _dispatcher;
+    private readonly Action<LauncherInstallRecord> _onInstalled;
+    private readonly Func<bool> _canOpen;
+    private readonly Func<bool> _canStart;
+    private CancellationTokenSource? _cancellation;
+    private string _datDirectory = string.Empty;
+    private string _threadsText = Math.Max(1, Environment.ProcessorCount).ToString();
+    private string _status = "Choose the folder containing the retail DAT files.";
+    private string _validationStatus = "No DAT directory selected.";
+    private string _missingFiles = string.Empty;
+    private string? _error;
+    private LauncherInstallPhase _phase = LauncherInstallPhase.Idle;
+    private double _progressPercent;
+    private bool _isOpen;
+    private bool _isRunning;
+    private bool _isDatDirectoryValid;
+    private bool _disposed;
+
+    public FirstRunInstallerViewModel(
+        ILauncherInstaller installer,
+        IUiDispatcher dispatcher,
+        Action<LauncherInstallRecord> onInstalled,
+        Func<bool>? canOpen = null,
+        Func<bool>? canStart = null)
+    {
+        _installer = installer ?? throw new ArgumentNullException(nameof(installer));
+        _dispatcher = dispatcher ?? throw new ArgumentNullException(nameof(dispatcher));
+        _onInstalled = onInstalled ?? throw new ArgumentNullException(nameof(onInstalled));
+        _canOpen = canOpen ?? (() => true);
+        _canStart = canStart ?? (() => true);
+
+        OpenCommand = new RelayCommand(Open, () => !_disposed && _canOpen());
+        CloseCommand = new RelayCommand(Close, () => !IsRunning);
+        ValidateCommand = new RelayCommand(Validate, () => !IsRunning);
+        StartCommand = new AsyncRelayCommand(StartAsync, CanBeginInstall);
+        CancelCommand = new RelayCommand(
+            () => _cancellation?.Cancel(),
+            () => IsRunning && _cancellation is not null);
+    }
+
+    public string Title => "First-run setup";
+
+    public string Body =>
+        "Select the retail Asheron's Call DAT folder. acdream will validate "
+        + "the four required files, build DataDirectory/pak/acdream.pak, and "
+        + "verify its SHA-256 before enabling launch.";
+
+    public string DatDirectory
+    {
+        get => _datDirectory;
+        set
+        {
+            if (SetProperty(ref _datDirectory, value ?? string.Empty))
+            {
+                Validate();
+            }
+        }
+    }
+
+    public string ThreadsText
+    {
+        get => _threadsText;
+        set
+        {
+            if (SetProperty(ref _threadsText, value ?? string.Empty))
+            {
+                OnPropertyChanged(nameof(IsThreadCountValid));
+                OnPropertyChanged(nameof(ThreadCountValidation));
+                NotifyCommandStates();
+            }
+        }
+    }
+
+    public bool IsThreadCountValid =>
+        int.TryParse(ThreadsText, out int threads) && threads > 0;
+
+    public string ThreadCountValidation => IsThreadCountValid
+        ? "Worker count is valid."
+        : "Threads must be a positive whole number.";
+
+    public string Status
+    {
+        get => _status;
+        private set => SetProperty(ref _status, value);
+    }
+
+    public string ValidationStatus
+    {
+        get => _validationStatus;
+        private set => SetProperty(ref _validationStatus, value);
+    }
+
+    public string MissingFiles
+    {
+        get => _missingFiles;
+        private set
+        {
+            if (SetProperty(ref _missingFiles, value))
+            {
+                OnPropertyChanged(nameof(HasMissingFiles));
+            }
+        }
+    }
+
+    public bool HasMissingFiles => MissingFiles.Length > 0;
+
+    public string? Error
+    {
+        get => _error;
+        private set
+        {
+            if (SetProperty(ref _error, value))
+            {
+                OnPropertyChanged(nameof(HasError));
+            }
+        }
+    }
+
+    public bool HasError => !string.IsNullOrWhiteSpace(Error);
+
+    public LauncherInstallPhase Phase
+    {
+        get => _phase;
+        private set => SetProperty(ref _phase, value);
+    }
+
+    public double ProgressPercent
+    {
+        get => _progressPercent;
+        private set => SetProperty(ref _progressPercent, value);
+    }
+
+    public bool IsProgressIndeterminate =>
+        IsRunning && ProgressPercent <= 0;
+
+    public bool CanEditInputs => !IsRunning;
+
+    public bool IsOpen
+    {
+        get => _isOpen;
+        private set => SetProperty(ref _isOpen, value);
+    }
+
+    public bool IsRunning
+    {
+        get => _isRunning;
+        private set
+        {
+            if (SetProperty(ref _isRunning, value))
+            {
+                OnPropertyChanged(nameof(IsProgressIndeterminate));
+                OnPropertyChanged(nameof(CanEditInputs));
+                NotifyCommandStates();
+            }
+        }
+    }
+
+    public bool IsDatDirectoryValid
+    {
+        get => _isDatDirectoryValid;
+        private set
+        {
+            if (SetProperty(ref _isDatDirectoryValid, value))
+            {
+                NotifyCommandStates();
+            }
+        }
+    }
+
+    public RelayCommand OpenCommand { get; }
+
+    public RelayCommand CloseCommand { get; }
+
+    public RelayCommand ValidateCommand { get; }
+
+    public AsyncRelayCommand StartCommand { get; }
+
+    public RelayCommand CancelCommand { get; }
+
+    public void SelectDatDirectory(string directory) => DatDirectory = directory;
+
+    public void ReportPickerError(string message)
+    {
+        Error = string.IsNullOrWhiteSpace(message)
+            ? "The DAT directory picker failed."
+            : message;
+    }
+
+    public void NotifyCommandStates()
+    {
+        OpenCommand.NotifyCanExecuteChanged();
+        CloseCommand.NotifyCanExecuteChanged();
+        ValidateCommand.NotifyCanExecuteChanged();
+        StartCommand.NotifyCanExecuteChanged();
+        CancelCommand.NotifyCanExecuteChanged();
+    }
+
+    public void Close()
+    {
+        if (!IsRunning)
+        {
+            IsOpen = false;
+        }
+    }
+
+    public void Dispose()
+    {
+        if (_disposed)
+        {
+            return;
+        }
+
+        _disposed = true;
+        _cancellation?.Cancel();
+        _cancellation?.Dispose();
+        _cancellation = null;
+        NotifyCommandStates();
+    }
+
+    private void Open()
+    {
+        if (string.IsNullOrWhiteSpace(DatDirectory))
+        {
+            IReadOnlyList<DatDirectoryValidation> candidates =
+                _installer.DetectDatDirectories();
+            DatDirectoryValidation? preferred =
+                candidates.FirstOrDefault(candidate => candidate.IsValid)
+                ?? candidates.FirstOrDefault();
+            if (preferred is not null)
+            {
+                _datDirectory = preferred.Directory;
+                OnPropertyChanged(nameof(DatDirectory));
+            }
+        }
+
+        Validate();
+        IsOpen = true;
+    }
+
+    private void Validate()
+    {
+        if (IsRunning)
+        {
+            return;
+        }
+
+        DatDirectoryValidation validation =
+            _installer.ValidateDatDirectory(DatDirectory);
+        IsDatDirectoryValid = validation.IsValid;
+        ValidationStatus = validation.Message;
+        MissingFiles = validation.MissingFileNames.Count == 0
+            ? string.Empty
+            : "Missing: " + string.Join(", ", validation.MissingFileNames);
+        Error = null;
+        NotifyCommandStates();
+    }
+
+    private bool CanBeginInstall() =>
+        !_disposed
+        && IsOpen
+        && !IsRunning
+        && IsDatDirectoryValid
+        && IsThreadCountValid
+        && _canStart();
+
+    private async Task StartAsync()
+    {
+        if (!int.TryParse(ThreadsText, out int threads) || threads <= 0)
+        {
+            return;
+        }
+
+        using var cancellation = new CancellationTokenSource();
+        _cancellation = cancellation;
+        IsRunning = true;
+        Error = null;
+        ProgressPercent = 0;
+        Phase = LauncherInstallPhase.ValidatingDatFiles;
+        Status = "Starting installation...";
+
+        var progress = new CallbackProgress<LauncherInstallProgress>(value =>
+            _dispatcher.Post(() => ApplyProgress(value)));
+        try
+        {
+            LauncherInstallResult result = await _installer.InstallAsync(
+                    DatDirectory,
+                    threads,
+                    progress,
+                    cancellation.Token)
+                .ConfigureAwait(true);
+            _onInstalled(result.Record);
+            Phase = LauncherInstallPhase.Completed;
+            ProgressPercent = 100;
+            Status = "Client content installed and verified. Launch is enabled.";
+        }
+        catch (OperationCanceledException)
+        {
+            Phase = LauncherInstallPhase.Cancelled;
+            Status = "Installation cancelled. The previous verified install was preserved.";
+        }
+        catch (Exception ex)
+        {
+            Phase = LauncherInstallPhase.Failed;
+            Error = string.IsNullOrWhiteSpace(ex.Message)
+                ? "Installation failed."
+                : ex.Message;
+            Status = "Installation failed; no new install record was published.";
+        }
+        finally
+        {
+            if (ReferenceEquals(_cancellation, cancellation))
+            {
+                _cancellation = null;
+            }
+
+            IsRunning = false;
+        }
+    }
+
+    private void ApplyProgress(LauncherInstallProgress progress)
+    {
+        if (_disposed)
+        {
+            return;
+        }
+
+        Phase = progress.Phase;
+        Status = progress.Status;
+        ProgressPercent = progress.Total > 0
+            ? progress.Fraction * 100
+            : 0;
+        OnPropertyChanged(nameof(IsProgressIndeterminate));
+    }
+
+    private sealed class CallbackProgress<T>(Action<T> callback) : IProgress<T>
+    {
+        private readonly Action<T> _callback = callback
+            ?? throw new ArgumentNullException(nameof(callback));
+
+        public void Report(T value) => _callback(value);
+    }
+}
+
+internal sealed class UnavailableLauncherInstaller : ILauncherInstaller
+{
+    public IReadOnlyList<DatDirectoryValidation> DetectDatDirectories() => [];
+
+    public DatDirectoryValidation ValidateDatDirectory(string? directory) =>
+        new(
+            directory ?? string.Empty,
+            false,
+            "The installer service is unavailable in this host.",
+            DatDirectoryLocator.RequiredFileNames);
+
+    public Task<InstallRecordVerification> LoadExistingAsync(
+        CancellationToken cancellationToken = default) =>
+        Task.FromResult(new InstallRecordVerification(
+            InstallRecordVerificationState.Missing,
+            null,
+            "The installer service is unavailable in this host."));
+
+    public Task<LauncherInstallResult> InstallAsync(
+        string datDirectory,
+        int threads,
+        IProgress<LauncherInstallProgress>? progress = null,
+        CancellationToken cancellationToken = default) =>
+        Task.FromException<LauncherInstallResult>(
+            new LauncherInstallException(
+                "The installer service is unavailable in this host."));
+}

src/AcDream.Launcher/ViewModels/LauncherWindowViewModel.cs

@@ -1,5 +1,7 @@
 using System.Collections.ObjectModel;
 using System.ComponentModel;
+using AcDream.Launcher.Core.Installation;
+using AcDream.Launcher.Core.Launching;
 using AcDream.Launcher.Core.Orchestration;
 using AcDream.Launcher.Core.Profiles;
 
@@ -22,20 +24,20 @@ public sealed class LauncherWindowViewModel : ObservableObject, IDisposable
 
     public LauncherWindowViewModel(
         ILauncherOrchestrator orchestrator,
-        IUiDispatcher dispatcher)
+        IUiDispatcher dispatcher,
+        ILauncherInstaller? installer = null)
     {
         _orchestrator = orchestrator ?? throw new ArgumentNullException(nameof(orchestrator));
         _dispatcher = dispatcher ?? throw new ArgumentNullException(nameof(dispatcher));
         _orchestrator.StateChanged += OnOrchestratorStateChanged;
 
         EditorDialog = new ProfileEditorDialogViewModel();
-        FirstRunWizardShell = new LauncherShellViewModel(
-            "First-run setup",
-            "Choose and validate the retail DAT directory, build acdream.pak, "
-                + "and record the installed client. The installer transaction and "
-                + "progress body land in Campaign LA slice LA9.",
-            "Installer shell ready — implementation arrives in LA9.",
-            () => CanInteract);
+        FirstRunWizardShell = new FirstRunInstallerViewModel(
+            installer ?? new UnavailableLauncherInstaller(),
+            dispatcher,
+            OnInstallCompleted,
+            () => CanInteract,
+            () => !IsBusy && Sessions.All(session => !session.IsActive));
         UpdatePromptShell = new LauncherShellViewModel(
             "Client update",
             "Review a signed release manifest, verify the downloaded archive, "
@@ -88,7 +90,7 @@ public sealed class LauncherWindowViewModel : ObservableObject, IDisposable
 
     public ProfileEditorDialogViewModel EditorDialog { get; }
 
-    public LauncherShellViewModel FirstRunWizardShell { get; }
+    public FirstRunInstallerViewModel FirstRunWizardShell { get; }
 
     public LauncherShellViewModel UpdatePromptShell { get; }
 
@@ -332,6 +334,7 @@ public sealed class LauncherWindowViewModel : ObservableObject, IDisposable
         EditorDialog.PropertyChanged -= OnModalPropertyChanged;
         FirstRunWizardShell.PropertyChanged -= OnModalPropertyChanged;
         UpdatePromptShell.PropertyChanged -= OnModalPropertyChanged;
+        FirstRunWizardShell.Dispose();
     }
 
     private void OnOrchestratorStateChanged(object? sender, EventArgs e) =>
@@ -346,7 +349,8 @@ public sealed class LauncherWindowViewModel : ObservableObject, IDisposable
     private void OnModalPropertyChanged(object? sender, PropertyChangedEventArgs e)
     {
         if (e.PropertyName != nameof(ProfileEditorDialogViewModel.IsOpen)
-            && e.PropertyName != nameof(LauncherShellViewModel.IsOpen))
+            && e.PropertyName != nameof(LauncherShellViewModel.IsOpen)
+            && e.PropertyName != nameof(FirstRunInstallerViewModel.IsOpen))
         {
             return;
         }
@@ -370,7 +374,7 @@ public sealed class LauncherWindowViewModel : ObservableObject, IDisposable
         }
         else if (FirstRunWizardShell.IsOpen)
         {
-            FirstRunWizardShell.IsOpen = false;
+            FirstRunWizardShell.Close();
         }
         else if (UpdatePromptShell.IsOpen)
         {
@@ -964,6 +968,14 @@ public sealed class LauncherWindowViewModel : ObservableObject, IDisposable
             : message;
     }
 
+    private void OnInstallCompleted(LauncherInstallRecord record)
+    {
+        _orchestrator.SetInstallRecord(record);
+        OperationStatus = "Client content installed and verified.";
+        LastError = null;
+        RefreshFromCore();
+    }
+
     private void NotifyCommandStates()
     {
         AddServerCommand.NotifyCanExecuteChanged();

src/AcDream.Platform/BakePublicationGuardPaths.cs

@@ -0,0 +1,35 @@
+namespace AcDream.Platform;
+
+/// <summary>
+/// Portable, versioned naming contract shared by the launcher parent and the
+/// independently published bake child. The durable token grants one child
+/// permission to publish while the adjacent OS-held lock serializes its final
+/// promotion with launcher recovery.
+/// </summary>
+public static class BakePublicationGuardPaths
+{
+    public const string NonceEnvironmentVariable =
+        "ACDREAM_BAKE_PUBLISH_NONCE_V1";
+    public const string PublishLockSuffix = ".publish.lock";
+    public const string AuthorizationSuffix = ".publish-token";
+
+    public static string CreateNonce() => Guid.NewGuid().ToString("N");
+
+    public static bool IsValidNonce(string? nonce) =>
+        nonce is not null
+        && nonce.Length == 32
+        && Guid.TryParseExact(nonce, "N", out Guid parsed)
+        && string.Equals(parsed.ToString("N"), nonce, StringComparison.Ordinal);
+
+    public static string GetPublishLockPath(string outputPath)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(outputPath);
+        return Path.GetFullPath(outputPath) + PublishLockSuffix;
+    }
+
+    public static string GetAuthorizationPath(string outputPath)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(outputPath);
+        return Path.GetFullPath(outputPath) + AuthorizationSuffix;
+    }
+}