Launcher (#4)

* 激进的更新

* 试试

* fix.可爱的我一直在修CI（

* fix.启动器一定要能够启动

* feat.尝试弄了AOT的启动器。

* fix.修CI，好像是因为Linux那边有个问题，反正修就对了。

* fix.ci难修，为什么liunx跑不起来呢？

* Update build.yml

* Update LanMountainDesktop.csproj

* changed.调整了启动逻辑，优化了更新页面。

* changed.优化了更新体验

* feat.依旧试增量更新这一块，看看velopack

* fix.我们试验性地修复了启动器无法正常启动的问题，原因可能是这个画面没有启动，就GUI没显示。然后还把编译问题修了一下。

* fix.继续修ci，ci怎么天天炸

* changed.velopack，试试rust

* fix.修ci，修融合桌面，修启动器

* fix.GitHub Action工作流怎么天天出问题

* feat.引入velopack，不好，是rust（至少内存很安全了。

* chore: migrate release pipeline to signed filemap and wire rainyun s3

* fix: make optional s3 upload step workflow-parse safe

* fix: make delta pack generation robust for empty diffs and linux paths

* chore: rotate launcher update public key for pdc signing

* fix: restore stable launcher update public key

* fix: sync launcher public key with update signing secret

* fix: normalize PEM line endings in signing key validation

* fix: rotate launcher public key to match ci signing secret

* fix: compare signing keys by SPKI instead of PEM text

* refactor update backend to host-managed PDC pipeline

* fix release workflow env key collisions

* relax publish-pdc precheck to require S3 only

* set GH_TOKEN for PDCC installer step

* ci: add local pdc mock fallback for release publish

* ci: fix pdc mock process log redirection

* ci: fallback pdcc signing key to update private key

* ci: ensure pdcc signing passphrase env is always set

* ci: create pdcc publish root before invoking client

* ci: set pdcc version variable from release version

* ci: decouple pdcc installer version from publish config version

* ci: package pdcc subchannels with generated filemap and changelog

* ci: make local pdc mock diff return empty for fast fallback

* ci: fix pdcc variable mapping and pdc signing prechecks

* Update App.axaml.cs

* ci: wire aws cli credentials for rainyun s3

* ci: pin pdcc client version separately from app version

* ci: harden local pdc mock transport handling

* ci: publish pdcc subchannels in one pass

* ci: add pdcc publish heartbeat and timeout

* ci: fix pdcc publish workdir bootstrap

* feat.Penguin Logistics Online Network Distribution System

* ci: fix plonds s3 probe and signing fallback

* ci: validate signing key and quiet missing baselines

* ci: relax aws checksum mode for rainyun s3

* ci: avoid multipart uploads to rainyun s3

* ci: handle empty plonds baselines safely

* ci.plonds

* Rebuild release pipeline around PLONDS and DDSS

* Fix Windows installer script path in release workflow

docs/DEVELOPMENT.md

@@ -20,10 +20,32 @@ dotnet build LanMountainDesktop.slnx -c Debug
 
 #### 运行桌面宿主
 
+**开发模式 (直接运行主程序,跳过 Launcher):**
 ```bash
 dotnet run --project LanMountainDesktop/LanMountainDesktop.csproj
 ```
 
+**生产模式 (通过 Launcher 启动):**
+```bash
+# 先构建 Launcher
+dotnet build LanMountainDesktop.Launcher/LanMountainDesktop.Launcher.csproj -c Debug
+
+# 通过 Launcher 启动主程序
+dotnet run --project LanMountainDesktop.Launcher/LanMountainDesktop.Launcher.csproj -- launch
+```
+
+**Launcher 其他命令:**
+```bash
+# 检查更新
+dotnet run --project LanMountainDesktop.Launcher/LanMountainDesktop.Launcher.csproj -- update check
+
+# 安装插件
+dotnet run --project LanMountainDesktop.Launcher/LanMountainDesktop.Launcher.csproj -- plugin install <path-to-plugin.laapp>
+
+# 版本回退
+dotnet run --project LanMountainDesktop.Launcher/LanMountainDesktop.Launcher.csproj -- update rollback
+```
+
 #### 运行测试
 
 ```bash
@@ -33,13 +55,18 @@ dotnet test LanMountainDesktop.slnx -c Debug
 ### 常见工作区域
 
 - 宿主应用：`LanMountainDesktop/`
+- **Launcher (启动器)：`LanMountainDesktop.Launcher/`**
 - Plugin SDK：`LanMountainDesktop.PluginSdk/`
 - 共享契约：`LanMountainDesktop.Shared.Contracts/`
 - 测试：`LanMountainDesktop.Tests/`
 - 插件打包脚本：`scripts/Pack-PluginPackages.ps1`
+- **增量更新脚本：`scripts/Generate-DeltaPackage.ps1`, `scripts/Sign-FileMap.ps1`**
 
 ### 调试建议
 
+- **Launcher 启动问题优先看 `LanMountainDesktop.Launcher/Program.cs` 和 `Services/LauncherFlowCoordinator.cs`**
+- **版本管理问题优先看 `LanMountainDesktop.Launcher/Services/DeploymentLocator.cs`**
+- **更新系统问题优先看 `LanMountainDesktop.Launcher/Services/UpdateEngineService.cs` 和 `UpdateCheckService.cs`**
 - 启动问题优先看 `LanMountainDesktop/Program.cs` 和 `LanMountainDesktop/App.axaml.cs`
 - 设置窗口和设置页问题优先看 `LanMountainDesktop/Views/`、`ViewModels/` 与相关 `Services/`
 - 插件加载与安装问题优先看 `LanMountainDesktop/plugins/`
@@ -74,8 +101,75 @@ dotnet test LanMountainDesktop.slnx -c Debug
 - 需求与实施拆解更新到 `.trae/specs/`
 - AI 协作入口和代码地图更新到 `AGENTS.md` 与 `docs/ai/`
 
+### Launcher 架构说明
+
+LanMountainDesktop 使用 Launcher 作为唯一入口,负责版本管理、更新和启动主程序。
+
+#### 目录结构
+
+安装后的目录结构:
+```
+C:\Program Files\LanMountainDesktop\
+├── LanMountainDesktop.Launcher.exe  ← 唯一入口
+├── app-1.0.0/                        ← 版本目录
+│   ├── .current                      ← 当前版本标记
+│   ├── LanMountainDesktop.exe
+│   └── ... (所有依赖)
+├── app-1.0.1/                        ← 新版本
+│   ├── .partial                      ← 下载中标记
+│   └── ...
+└── .launcher/                        ← Launcher 数据
+    ├── state/                        ← OOBE 状态
+    ├── update/incoming/              ← 更新缓存
+    └── snapshots/                    ← 更新快照
+```
+
+#### 版本标记文件
+
+- `.current` - 标记当前使用的版本
+- `.partial` - 标记下载未完成的版本
+- `.destroy` - 标记待删除的旧版本
+
+#### 启动流程
+
+1. 用户启动 `LanMountainDesktop.Launcher.exe`
+2. Launcher 扫描 `app-*` 目录,选择最佳版本
+3. 如果是首次启动,显示 OOBE 引导
+4. 显示 Splash 启动动画
+5. 检查并应用待处理的更新
+6. 处理插件升级队列
+7. 启动主程序 `app-{version}/LanMountainDesktop.exe`
+8. 清理标记为 `.destroy` 的旧版本
+
+#### 更新流程
+
+1. Launcher 调用 GitHub Release API 检查更新
+2. 根据更新频道(Stable/Preview)过滤版本
+3. 下载增量包到 `app-{new_version}/` 并标记 `.partial`
+4. 验证文件完整性(SHA256)
+5. 删除 `.partial`,添加 `.current` 到新版本
+6. 标记旧版本 `.destroy`
+7. 下次启动时自动清理
+
+#### 版本回退
+
+```bash
+dotnet run --project LanMountainDesktop.Launcher/LanMountainDesktop.Launcher.csproj -- update rollback
+```
+
+回退会切换到上一个有效版本,并保留快照记录。
+
 ## English
 
 Use `LanMountainDesktop.slnx` as the workspace entry point. The standard loop is `dotnet restore`, `dotnet build LanMountainDesktop.slnx -c Debug`, `dotnet run --project LanMountainDesktop/LanMountainDesktop.csproj`, and `dotnet test LanMountainDesktop.slnx -c Debug`.
 
 For packaging, see `LanMountainDesktop/PACKAGING.md`. For plugin package generation or local feed workflows, use `scripts/Pack-PluginPackages.ps1`.
+
+**Launcher Architecture**: LanMountainDesktop uses a Launcher as the single entry point, responsible for version management, updates, and launching the main application. See the Chinese section above for detailed architecture documentation.
+
+## VeloPack Release Assets
+
+- Windows incremental release packaging now uses VeloPack native outputs (
+eleases.win.json, *.nupkg).
+- Launcher still performs update apply/rollback; VeloPack is used for package generation.
+- Legacy delta script flow is retained behind a disabled fallback switch in CI.