feat(launcher): stabilize prepared content updates

docs/architecture/acdream-architecture.md

@@ -332,7 +332,19 @@ src/
     Installation/            -> portable four-DAT validation, Windows retail
                                 path discovery, versioned JSONL bake-process
                                 orchestration, and atomic SHA/size/tool-version
-                                install-record verification and recovery; one
+                                install-record verification and recovery;
+                                startup discovery begins only after the desktop
+                                window opens, and exceptional whole-pak hashing
+                                reports its long-read status in that window;
+                                content recipes resolve through one compiled
+                                None/Overlay/FullRebuild/Verify migration ledger;
+                                bounded changes build one cumulative filtered
+                                overlay and publish `pak/content.current.json`,
+                                while full rebuilds bake beside the live base and
+                                swap only after candidate verification; a tiny
+                                `pak/content.client-pending` gate survives a
+                                crash/restart until the active client is
+                                confirmed compatible; one
                                 OS-handle lease serializes recovery/install per
                                 DataDirectory; a second OS-held publication
                                 lock plus durable per-transaction nonce makes
@@ -362,7 +374,9 @@ src/
                                 is never persisted, and permits HTTP only for a
                                 loopback fixture; production remains pinned HTTPS
     ViewModels/              -> thin MVVM projection over Launcher.Core,
-                                including the first-run DAT/bake wizard and
+                                including the first-run DAT/bake wizard, explicit
+                                world-data work confirmation (kind, reason,
+                                free-space guidance, progress/cancellation), and
                                 nonfatal startup/manual update state, actions,
                                 progress, cancellation, rollback, and errors
     -> references Launcher.Core only (Platform transitively); it never owns
@@ -372,6 +386,19 @@ src/
     -> Linux launcher/probe/headless flows remain portable; graphical-client
        actions are explicitly disabled until Modern Runtime Slice L resumes
 
+  Prepared-content launch contract
+    -> `install.json` remains the strict backward-compatible base-pak authority
+    -> optional `pak/content.current.json` binds one cumulative overlay to the
+       base SHA; there is never an unbounded overlay chain
+    -> `pak/content.client-pending` prevents newly migrated content from
+       becoming launchable before the matching client check/install succeeds,
+       including across launcher restart
+    -> launcher session config carries base + optional overlay paths and both
+       recipe identities only for layered launches
+    -> App and Headless construct one `LayeredPreparedAssetSource`; overlay
+       Missing falls through to base, while overlay Corrupt is authoritative
+       for both render and collision reads
+
   AcDream.Headless/          Linux/Windows no-window production host
     Program.cs               -> CLI entry only
     Configuration/           -> strict versioned process/session config

docs/architecture/worldbuilder-inventory.md

@@ -132,6 +132,20 @@ bake/equivalence/UI-Studio tools, not a production fallback. Portal → HighRes
 installed-DAT gates are recorded in
 `docs/research/2026-07-24-slice-c-prepared-asset-cutover-report.md`.
 
+**Launcher cumulative-overlay extension (2026-08-25).** Production still has
+no live-DAT fallback and consumes the same prepared-payload contracts. For a
+bounded recipe migration, App and Headless may receive one complete base pak
+plus one cumulative filtered pak through `LayeredPreparedAssetSource`. The
+overlay is probed first: Missing falls through to the base, while a present but
+corrupt render or collision payload remains authoritative corruption. Both
+mapped owners share one composite lifetime and there is never an overlay
+chain. The launcher binds the overlay to the base digest in the optional
+`pak/content.current.json` sidecar; format/global extraction migrations retain
+the explicit full-rebuild path. A tiny `pak/content.client-pending` marker
+keeps either result non-launchable until the matching client is confirmed,
+including across a crash/restart. Design and gates:
+`docs/plans/2026-08-25-launcher-content-stabilization.md`.
+
 **Slice I3 prepared collision extension (2026-07-25).** The package remains
 format 1 and retains mesh type values 1–3; bake-tool 4 appends typed GfxObj,
 Setup, CellStruct, and EnvCell-topology collision payloads. Core owns the