feat(launcher): stabilize prepared content updates

docs/architecture/acdream-architecture.md

@@ -332,7 +332,19 @@ src/
     Installation/            -> portable four-DAT validation, Windows retail
                                 path discovery, versioned JSONL bake-process
                                 orchestration, and atomic SHA/size/tool-version
-                                install-record verification and recovery; one
+                                install-record verification and recovery;
+                                startup discovery begins only after the desktop
+                                window opens, and exceptional whole-pak hashing
+                                reports its long-read status in that window;
+                                content recipes resolve through one compiled
+                                None/Overlay/FullRebuild/Verify migration ledger;
+                                bounded changes build one cumulative filtered
+                                overlay and publish `pak/content.current.json`,
+                                while full rebuilds bake beside the live base and
+                                swap only after candidate verification; a tiny
+                                `pak/content.client-pending` gate survives a
+                                crash/restart until the active client is
+                                confirmed compatible; one
                                 OS-handle lease serializes recovery/install per
                                 DataDirectory; a second OS-held publication
                                 lock plus durable per-transaction nonce makes
@@ -362,7 +374,9 @@ src/
                                 is never persisted, and permits HTTP only for a
                                 loopback fixture; production remains pinned HTTPS
     ViewModels/              -> thin MVVM projection over Launcher.Core,
-                                including the first-run DAT/bake wizard and
+                                including the first-run DAT/bake wizard, explicit
+                                world-data work confirmation (kind, reason,
+                                free-space guidance, progress/cancellation), and
                                 nonfatal startup/manual update state, actions,
                                 progress, cancellation, rollback, and errors
     -> references Launcher.Core only (Platform transitively); it never owns
@@ -372,6 +386,19 @@ src/
     -> Linux launcher/probe/headless flows remain portable; graphical-client
        actions are explicitly disabled until Modern Runtime Slice L resumes
 
+  Prepared-content launch contract
+    -> `install.json` remains the strict backward-compatible base-pak authority
+    -> optional `pak/content.current.json` binds one cumulative overlay to the
+       base SHA; there is never an unbounded overlay chain
+    -> `pak/content.client-pending` prevents newly migrated content from
+       becoming launchable before the matching client check/install succeeds,
+       including across launcher restart
+    -> launcher session config carries base + optional overlay paths and both
+       recipe identities only for layered launches
+    -> App and Headless construct one `LayeredPreparedAssetSource`; overlay
+       Missing falls through to base, while overlay Corrupt is authoritative
+       for both render and collision reads
+
   AcDream.Headless/          Linux/Windows no-window production host
     Program.cs               -> CLI entry only
     Configuration/           -> strict versioned process/session config