feat.airapp剥离启动器

.trae/specs/air-app-runtime-container/checklist.md

@@ -0,0 +1,9 @@
+# Checklist
+
+- [x] `LanMountainDesktop.AirAppRuntime` is included in `LanMountainDesktop.slnx`.
+- [x] Launcher no longer hosts `IAirAppLifecycleService`.
+- [x] Host fallback starts `LanMountainDesktop.AirAppRuntime`, not `LanMountainDesktop.Launcher air-app-broker`.
+- [x] AirApp Runtime is explicitly non-AOT and framework-dependent.
+- [x] `dotnet build LanMountainDesktop.slnx -c Debug` passes.
+- [x] Related AirApp Runtime tests pass.
+- [x] `dotnet test LanMountainDesktop.slnx -c Debug` passes.

.trae/specs/air-app-runtime-container/spec.md

@@ -0,0 +1,21 @@
+# AirApp Runtime Container
+
+## Goal
+
+Move built-in Air APP lifecycle management out of Launcher into a dedicated framework-dependent JIT process named `LanMountainDesktop.AirAppRuntime`.
+
+## Behavior
+
+- Launcher remains the user-facing entry point and pre-starts AirApp Runtime during normal `launch`.
+- AirApp Runtime exposes `IAirAppLifecycleService` and `IAirAppRuntimeControlService` on `LanMountainDesktop.AirAppRuntime.v1`.
+- Desktop host requests Air APP operations through AirApp Runtime IPC.
+- If the runtime pipe is unavailable, the desktop host starts `LanMountainDesktop.AirAppRuntime` directly and retries.
+- AirApp Runtime keeps one AirAppHost process per `{appId}:{sourceComponentId}:{sourcePlacementId}` key, with `world-clock` sharing `world-clock:clock-suite:global`.
+- AirApp Runtime remains alive while Launcher, Host, requester, or any AirAppHost process is alive.
+- AirApp Runtime exits after Launcher/Host/requester are gone and no Air APP windows remain.
+
+## Out of Scope
+
+- Moving Air APP windows into the runtime process.
+- Third-party plugin-declared Air APP metadata.
+- Persisting the Air APP instance table across OS reboot.

.trae/specs/air-app-runtime-container/tasks.md

@@ -0,0 +1,11 @@
+# Tasks
+
+- [x] Add shared AirApp Runtime IPC/control contracts.
+- [x] Add shared AirApp Runtime path resolver and process starter.
+- [x] Add `LanMountainDesktop.AirAppRuntime` as a framework-dependent JIT process.
+- [x] Move Air APP lifecycle service out of Launcher.
+- [x] Make Launcher pre-start AirApp Runtime and attach Host PID after launch.
+- [x] Make Host fallback start AirApp Runtime instead of Launcher broker.
+- [x] Remove Launcher `air-app-broker` command handling.
+- [x] Update packaging scripts and release workflow to include AirApp Runtime.
+- [x] Update unit tests and architecture/package assertions.

.trae/specs/launcher-managed-air-app-lifecycle/checklist.md

@@ -1,5 +1,7 @@
 # Checklist
 
+> Superseded by `.trae/specs/air-app-runtime-container/`; the checked items below describe the former Launcher-managed implementation.
+
 - [x] `LanMountainDesktop.Shared.IPC` builds in Debug.
 - [x] `LanMountainDesktop.Launcher` builds in Debug.
 - [x] `LanMountainDesktop` builds in Debug.

.trae/specs/launcher-managed-air-app-lifecycle/spec.md

@@ -1,5 +1,7 @@
 # Launcher Managed Air APP Lifecycle
 
+> Superseded by `.trae/specs/air-app-runtime-container/`. Launcher no longer hosts the Air APP lifecycle broker; it pre-starts `LanMountainDesktop.AirAppRuntime`, which owns the lifecycle IPC and AirAppHost process table.
+
 ## Goal
 
 Make Launcher the authoritative lifecycle manager for built-in Air APP processes. The desktop host requests Air APP operations through IPC, while Launcher creates, activates, tracks, and cleans up Air APP host processes.

.trae/specs/launcher-managed-air-app-lifecycle/tasks.md

@@ -1,5 +1,7 @@
 # Tasks
 
+> Superseded by `.trae/specs/air-app-runtime-container/`; the checked items below describe the former Launcher-managed implementation.
+
 - [x] Add shared Air APP lifecycle IPC contracts.
 - [x] Add Launcher Air APP lifecycle service and dedicated IPC host.
 - [x] Make Launcher remain alive while desktop or Air APP processes exist.

.trae/specs/launcher-oobe-elevation-hardening/checklist.md

@@ -3,7 +3,7 @@
 - [ ] New install shows OOBE once.
 - [ ] Same-user reinstall does not show OOBE again.
 - [ ] `postinstall` launch path is handled without misclassifying the user state.
-- [ ] `apply-update` and `plugin-install` do not auto-enter OOBE.
+- [ ] `plugin-install` does not auto-enter OOBE.
 - [ ] Default plugin install does not request UAC.
 - [ ] Logs include OOBE status, suppression reason, and launch source.
 - [ ] Startup presentation step inside `OobeWindow` (after data location) writes host `settings.json` and syncs Windows Run when autostart is chosen (Launcher executable).

.trae/specs/launcher-oobe-elevation-hardening/spec.md

@@ -23,12 +23,11 @@ Stabilize the launcher startup path so that:
 - `launchSource` values are treated as:
   - `normal`
   - `postinstall`
-  - `apply-update`
   - `plugin-install`
   - `debug-preview`
 - Automatic OOBE is allowed only for normal user-mode startup.
 - `postinstall` may show OOBE only when the launcher is not elevated and user state is available.
-- `apply-update`, `plugin-install`, and `debug-preview` must not auto-enter OOBE.
+- `plugin-install` and `debug-preview` must not auto-enter OOBE.
 - Allowed elevation paths are limited to:
   - the installer itself
   - full installer update application

.trae/specs/update-settings-fluent-controls/spec.md

@@ -15,7 +15,7 @@ Make the Settings > Update page the single user-facing control surface for the h
 - Users can opt into forced reinstall. When enabled, the update check targets the current version manifest where available and the UI labels the next payload as reinstall.
 - The page displays whether the current payload is an incremental update or reinstall/full installer.
 - The page exposes pause, resume, and cancel actions for resumable downloads and install recovery.
-- Existing PloNDS/FileMap incremental update and Launcher rollback ownership remain unchanged.
+- Existing PloNDS/FileMap incremental update behavior remains, but update apply and rollback ownership belongs to the Host. Launcher only selects and starts the current app version.
 
 ## Acceptance
 

.trae/specs/velopack-update-integration/spec.md

@@ -8,7 +8,7 @@ This spec is deprecated and superseded by `.trae/specs/pdc-incremental-migration
 
 - VeloPack native package generation introduced unstable release blocking (version format coupling and platform divergence).
 - The project has switched back to signed FileMap incremental assets as the primary update path.
-- Launcher remains the update installer/rollback authority; packaging and distribution are being migrated to PDC/S3-compatible flows.
+- Host owns update install and rollback authority; packaging and distribution are being migrated to PDC/S3-compatible flows. Launcher only selects and starts the current app version.
 
 ## Migration Note