diff --git a/architecture/autodesk-launcher/README.md b/architecture/autodesk-launcher/README.md
new file mode 100644
index 0000000..d2020a1
--- /dev/null
+++ b/architecture/autodesk-launcher/README.md
@@ -0,0 +1,7 @@
+# Autodesk Launcher architecture
+
+This section is the single architecture record for the corporate Autodesk launcher, its legacy P_Rec_Annot loading path, and the parallel Launcher Next foundation. Statements are labelled `CONFIRMED`, `HIGH_CONFIDENCE`, `INFERRED`, or `UNKNOWN` and link to the audit evidence map.
+
+The AS-IS flow is a locally synchronized legacy deployment with generated AutoLISP loading. Launcher Next is a .NET 8, one-visible-EXE design that stages signed-by-hash local packages and loads one managed entry assembly. It is a design/foundation only: production configuration, AutoCAD profiles, trusted paths, network roots and deploys were not changed.
+
+See [AS-IS](as-is/system-context.md), [target](target/architecture.md), [ADRs](adr/ADR-001-parallel-rewrite.md), and [evidence map](evidence-map.csv).
diff --git a/architecture/autodesk-launcher/adr/ADR-001-parallel-rewrite.md b/architecture/autodesk-launcher/adr/ADR-001-parallel-rewrite.md
new file mode 100644
index 0000000..59a4282
--- /dev/null
+++ b/architecture/autodesk-launcher/adr/ADR-001-parallel-rewrite.md
@@ -0,0 +1,3 @@
+# ADR-001: Parallel rewrite
+
+**Decision:** build Launcher Next beside legacy. **Status:** accepted. **Why:** legacy installer performs destructive synchronization and runtime bootstrap remains partly unknown. **Consequence:** Legacy remains default and rollback is immediate.
diff --git a/architecture/autodesk-launcher/adr/ADR-002-single-managed-entrypoint.md b/architecture/autodesk-launcher/adr/ADR-002-single-managed-entrypoint.md
new file mode 100644
index 0000000..9a29596
--- /dev/null
+++ b/architecture/autodesk-launcher/adr/ADR-002-single-managed-entrypoint.md
@@ -0,0 +1,3 @@
+# ADR-002: Single managed entrypoint
+
+**Decision:** NETLOAD only `PRecAnnot.Plant3D2026.dll`. **Status:** accepted. **Why:** removes orchestration of 20 independent loads and centralizes commands/Ribbon. **Consequence:** internal dependencies must be packaged as CLR dependencies, not NETLOAD targets.
diff --git a/architecture/autodesk-launcher/adr/ADR-003-local-versioned-cache.md b/architecture/autodesk-launcher/adr/ADR-003-local-versioned-cache.md
new file mode 100644
index 0000000..8c51918
--- /dev/null
+++ b/architecture/autodesk-launcher/adr/ADR-003-local-versioned-cache.md
@@ -0,0 +1,3 @@
+# ADR-003: Local versioned cache
+
+**Decision:** activate immutable local versions through a pointer. **Status:** accepted. **Why:** avoids in-use DLL replacement and supports offline starts. **Consequence:** retain current/previous versions and clean staging separately.
diff --git a/architecture/autodesk-launcher/adr/ADR-004-atomic-update.md b/architecture/autodesk-launcher/adr/ADR-004-atomic-update.md
new file mode 100644
index 0000000..1bee481
--- /dev/null
+++ b/architecture/autodesk-launcher/adr/ADR-004-atomic-update.md
@@ -0,0 +1,3 @@
+# ADR-004: Atomic update
+
+**Decision:** stage, validate, rename then switch pointer. **Status:** accepted. **Why:** prevents partial activation. **Consequence:** locked/cancelled updates retain current version and report diagnostics.
diff --git a/architecture/autodesk-launcher/adr/ADR-005-legacy-fallback.md b/architecture/autodesk-launcher/adr/ADR-005-legacy-fallback.md
new file mode 100644
index 0000000..c379c17
--- /dev/null
+++ b/architecture/autodesk-launcher/adr/ADR-005-legacy-fallback.md
@@ -0,0 +1,3 @@
+# ADR-005: Legacy fallback
+
+**Decision:** mode flag defaults to Legacy; NextPilot requires explicit selection. **Status:** accepted. **Why:** startup evidence is incomplete and production configuration must not be changed implicitly. **Consequence:** launcher must not start AutoCAD twice after a Next failure.
diff --git a/architecture/autodesk-launcher/adr/ADR-006-no-direct-unc-assembly-loading.md b/architecture/autodesk-launcher/adr/ADR-006-no-direct-unc-assembly-loading.md
new file mode 100644
index 0000000..fca0032
--- /dev/null
+++ b/architecture/autodesk-launcher/adr/ADR-006-no-direct-unc-assembly-loading.md
@@ -0,0 +1,3 @@
+# ADR-006: No direct UNC assembly loading
+
+**Decision:** validate and load only local package copies. **Status:** accepted. **Why:** network availability and mid-session replacement are unreliable; direct UNC loading is not proven as a required legacy contract. **Consequence:** a local cache is mandatory for Next packages.
diff --git a/architecture/autodesk-launcher/as-is/component-model.md b/architecture/autodesk-launcher/as-is/component-model.md
new file mode 100644
index 0000000..ba6535b
--- /dev/null
+++ b/architecture/autodesk-launcher/as-is/component-model.md
@@ -0,0 +1,10 @@
+# AS-IS component model
+
+`All_Serv_InstallUpdater` updates and launches `All_Serv_Install`; `All_Serv_Install` is the confirmed visible installer/synchronizer. `All_Serv_Load` is an independent historical/alternate executable. `P_Serv_Starter` is a separate bootstrap repository selected through installer configuration, not a project reference.
+
+```text
+Updater (optional) -> Visible installer -> local Applications cache -> P_Serv_Starter
+P_Serv_Starter -> generated LISP + local batch -> Plant 3D -> OrthoLoader -> module settings -> 20 DLL
+```
+
+Network access is established for installation/update. Legacy module loading is intended from local Applications, not proven to be direct UNC loading. The installed state was absent on the audited workstation.
diff --git a/architecture/autodesk-launcher/as-is/configuration-contracts.md b/architecture/autodesk-launcher/as-is/configuration-contracts.md
new file mode 100644
index 0000000..09f1e10
--- /dev/null
+++ b/architecture/autodesk-launcher/as-is/configuration-contracts.md
@@ -0,0 +1,11 @@
+# AS-IS configuration contracts
+
+| Contract | Format / owner | Consumer | Validation / fallback | Versioning / machine behavior | Confidence |
+|---|---|---|---|---|---|
+| Installer Settings.xml | XML, All_Serv_Install | installer and P_Serv_Starter | parse errors stop bootstrap; detailed fallback unknown | hard-coded server/local paths and machine rules | CONFIRMED |
+| Plugin catalog/install | XML fields | generated LISP | only existing local catalog emits load | order follows configuration | CONFIRMED |
+| OrthoLoader Settings.xml | XML, P_Rec deployment | OrthoLoader | per-module behavior partially known | ordered 20 module list | CONFIRMED |
+| AutoCAD executable/version | batch/source/config | local batch | exact current version unknown | machine-specific | HIGH_CONFIDENCE |
+| Profile/autoload | workstation AutoCAD config | AutoCAD | unknown | machine-specific | UNKNOWN |
+| Ribbon resources | deployed module resources/network possible | legacy modules | absence behavior unknown | unknown | UNKNOWN |
+| Offline mode | implicit local files | launcher/user | no proven policy | network dependent at sync | UNKNOWN |
diff --git a/architecture/autodesk-launcher/as-is/failure-modes.md b/architecture/autodesk-launcher/as-is/failure-modes.md
new file mode 100644
index 0000000..f408476
--- /dev/null
+++ b/architecture/autodesk-launcher/as-is/failure-modes.md
@@ -0,0 +1,12 @@
+# AS-IS failure modes
+
+| Failure | Detection | Current handling | User-visible result | Data risk | Recovery | Target handling |
+|---|---|---|---|---|---|---|
+| Network unavailable | filesystem/XML operation | incomplete evidence | install/update may fail | stale files | unknown | use valid local cache |
+| Partial copy / version skew | no proven transaction | copy/delete code | missing module | load failure | reinstall | staging + atomic pointer |
+| Missing DLL / corrupted Settings.xml | generated load or loader parse | warnings/behavior varies | command/ribbon missing | none to DWG at load | manual repair | manifest validation |
+| One of 20 modules incompatible | ._netload result | sequential continuation unknown | partial functionality | inconsistent UI | manual repair | one entry package compatibility check |
+| Repeated NETLOAD / duplicate ribbon | runtime | module-specific | duplicate UI possible | UI only | restart | idempotent registry |
+| No write permission / AV lock | file operations | errors/messages vary | launch blocked | partial install | manual repair | diagnostics and no activation |
+| AutoCAD already running / profile missing / LISP/BAT absent | not fully proven | unknown | bootstrap may not execute | none | manual | explicit duplicate policy/preflight |
+| Update during use | legacy copy model | unknown | locked or mixed files | runtime instability | manual | versioned immutable directories |
diff --git a/architecture/autodesk-launcher/as-is/file-flow.md b/architecture/autodesk-launcher/as-is/file-flow.md
new file mode 100644
index 0000000..382e1e7
--- /dev/null
+++ b/architecture/autodesk-launcher/as-is/file-flow.md
@@ -0,0 +1,13 @@
+# AS-IS file flow
+
+| File | Created/copied by | Source -> destination | Read/executed by | Generated | Required phase | Mutable | Failure impact | Target |
+|---|---|---|---|---|---|---|---|---|
+| P_Serv_Starter.exe | installer | configured local support location | installer | static | install | replaced by updater | no bootstrap | Next EXE workflow |
+| start_plant_3d.bat | external local support | expected local location | P_Serv_Starter | static | startup | external | Plant not started | ProcessStartInfo |
+| launcher_starter.lsp | P_Serv_Starter | bootstrap output -> Applications | AutoCAD (mechanism unknown) | copied | startup | overwritten | generated loader not activated | temporary Next script |
+| _app_netload.lsp | P_Serv_Starter | generated in Applications | launcher_starter | generated | startup | overwritten | no plugin load | temporary Next script |
+| app_netload.lsp | launcher_starter | renamed local generated file | AutoCAD | generated | startup | mutable | no selected plugin load | one NETLOAD script |
+| OrthoLoader.dll | installer | network catalog -> local Applications/P_Rec_Annot | AutoCAD | static | startup | versioned only by legacy copy | P_Rec chain fails | PRecAnnot entry assembly |
+| Settings.xml | legacy deployment | adjacent to loader | OrthoLoader | static | startup | network/local unknown | modules unavailable | versioned manifest |
+| P_Rec DLL / icons / help / templates / project XML | legacy catalog | network -> local catalog | modules | static | command dependent | varies | feature-specific failure | explicit optional resources |
+| AutoCAD profile references | workstation | external configuration | AutoCAD | static | startup | external | bootstrap may not run | explicit validated profile |
diff --git a/architecture/autodesk-launcher/as-is/installation-sequence.md b/architecture/autodesk-launcher/as-is/installation-sequence.md
new file mode 100644
index 0000000..e5fd1d6
--- /dev/null
+++ b/architecture/autodesk-launcher/as-is/installation-sequence.md
@@ -0,0 +1,17 @@
+# AS-IS installation sequence
+
+```mermaid
+sequenceDiagram
+ participant U as User
+ participant I as All_Serv_Install
+ participant N as Corporate network
+ participant C as Local Applications
+ participant S as P_Serv_Starter
+ U->>I: select product/plugins
+ I->>N: read Settings.xml and selected files
+ I->>C: recursively copy catalogs
+ I->>S: start with product, target, settings, project, workdir
+ S->>C: create _app_netload.lsp and launcher_starter.lsp
+```
+
+Partial-copy recovery and all offline branches are not fully proven.
diff --git a/architecture/autodesk-launcher/as-is/known-unknowns.md b/architecture/autodesk-launcher/as-is/known-unknowns.md
new file mode 100644
index 0000000..8274bed
--- /dev/null
+++ b/architecture/autodesk-launcher/as-is/known-unknowns.md
@@ -0,0 +1,8 @@
+# Known unknowns
+
+- `UNKNOWN_BOOTSTRAP`: automatic `launcher_starter.lsp` activation through `acaddoc.lsp`.
+- Actual runtime files and local cache were absent on the audited workstation.
+- Exact startup mechanism for every AutoCAD/Plant release and profile.
+- Network-offline behavior across all installer/updater/module branches.
+- Full per-module failure continuation, duplicate-load handling, resources and command-time network dependencies.
+- Actual deployed updater shortcut and current Plant executable arguments.
diff --git a/architecture/autodesk-launcher/as-is/performance-profile.md b/architecture/autodesk-launcher/as-is/performance-profile.md
new file mode 100644
index 0000000..d86893f
--- /dev/null
+++ b/architecture/autodesk-launcher/as-is/performance-profile.md
@@ -0,0 +1,3 @@
+# AS-IS performance profile
+
+The startup path performs network-dependent synchronization when installer/update is used, writes generated LISP files, starts a batch and may load 20 assemblies sequentially. No timings were collected; claims about latency, parallelism, cache hit rate, or behavior under unavailable network are `UNKNOWN`. Launcher Next must measure these rather than infer them.
diff --git a/architecture/autodesk-launcher/as-is/security-model.md b/architecture/autodesk-launcher/as-is/security-model.md
new file mode 100644
index 0000000..ee5be55
--- /dev/null
+++ b/architecture/autodesk-launcher/as-is/security-model.md
@@ -0,0 +1,3 @@
+# AS-IS security model
+
+Legacy code writes local support files and uses generated LISP plus `NETLOAD`. It relies on the corporate local trusted support convention, but this audit did not change or verify `TRUSTEDPATHS`, profiles, registry demand loading, or deployment permissions. Network source access occurs during installation/update. The audit does not establish code signing, strong validation, complete hash coverage, or secret handling. Treat all of those as gaps.
diff --git a/architecture/autodesk-launcher/as-is/startup-sequence.md b/architecture/autodesk-launcher/as-is/startup-sequence.md
new file mode 100644
index 0000000..6bf6230
--- /dev/null
+++ b/architecture/autodesk-launcher/as-is/startup-sequence.md
@@ -0,0 +1,24 @@
+# AS-IS startup sequence
+
+```mermaid
+sequenceDiagram
+  participant U as User
+  participant I as All_Serv_Install
+  participant S as P_Serv_Starter
+  participant B as start_plant_3d.bat
+  participant A as Plant 3D
+  participant L as launcher_starter.lsp
+  participant O as OrthoLoader.dll
+  U->>I: select Plant product/project
+  I->>S: start configured bootstrap
+  S->>S: create _app_netload.lsp; copy LISP
+  S->>B: Process.Start
+  B->>A: launch (details UNKNOWN)
+  Note over A,L: UNKNOWN_BOOTSTRAP: automatic LISP invocation not observed
+  L->>L: rename/load app_netload.lsp
+  L->>O: NETLOAD local OrthoLoader.dll
+  O->>O: read Settings.xml; ._netload ordered modules
+  O->>A: create PluginsOrtho ribbon
+```
+
+The lower sequence is conditional on `launcher_starter.lsp` being started; the initiating AutoCAD configuration is unknown.
diff --git a/architecture/autodesk-launcher/as-is/system-context.md b/architecture/autodesk-launcher/as-is/system-context.md
new file mode 100644
index 0000000..c3b3e0b
--- /dev/null
+++ b/architecture/autodesk-launcher/as-is/system-context.md
@@ -0,0 +1,19 @@
+# AS-IS system context
+
+| Component | Owner / repository | Process / runtime | Inputs / outputs | Side effects | Replacement | Evidence / confidence |
+|---|---|---|---|---|---|---|
+| User | Engineering | desktop | selects product and project | starts launcher | retained | launcher audit / CONFIRMED |
+| All_Serv_Install | `All_Serv_Install` | .NET Framework WinForms | server Settings.xml; local Applications; starts bootstrap | synchronizes and deletes local files | Launcher Next replaces gradually | launcher audit / CONFIRMED |
+| P_Serv_Starter | `P_Serv_Starter` | .NET Framework EXE | settings + paths; generated LISP | writes loader files; starts batch | Next startup builder | source audit / CONFIRMED |
+| start_plant_3d.bat | local support directory | cmd/batch | local support files | starts Plant process | direct ProcessStartInfo when viable | source reference only / HIGH_CONFIDENCE |
+| launcher_starter.lsp | P_Serv_Starter content | AutoLISP | `_app_netload.lsp` | updates SupportPath; loads generated LISP | temporary pilot script | source audit / CONFIRMED |
+| app_netload.lsp | generated locally | AutoLISP | plugin catalog/install entries | NETLOADs selected local modules | one entry NETLOAD | source audit / CONFIRMED |
+| AutoCAD Plant 3D | Autodesk | acad.exe, Plant runtime | profile, drawing, local plugin | executes commands | retained | product discovery / CONFIRMED |
+| OrthoLoader.dll | legacy P_Rec_Annot | managed AutoCAD extension | adjacent Settings.xml | loads 20 modules, ribbon | PRecAnnot.Plant3D2026.dll | legacy audit / CONFIRMED |
+| 20 legacy DLL | legacy deployment | managed extensions | Settings.xml ordered list | commands and ribbon behavior | consolidated dependencies | legacy audit / CONFIRMED |
+| Network root | corporate file share | SMB | legacy installation source | read at install/update | catalog source only | audits / CONFIRMED |
+| Local support directory | workstation | filesystem | cache, scripts and applications | local writes | configurable cache root | source audit / CONFIRMED |
+| AutoCAD profile / autoload registration | workstation configuration | AutoCAD startup | startup LISP | unknown | explicit Next configuration | no installed proof / UNKNOWN |
+| Plant project / Ribbon | Plant runtime | Plant/AutoCAD APIs | project and UI context | commands/transactions | retained through one entry assembly | legacy audit / CONFIRMED |
+
+`UNKNOWN_BOOTSTRAP`: source comments name `acaddoc.lsp`, but its deployed content and registration were not observed. It must not be represented as confirmed automatic startup.
diff --git a/architecture/autodesk-launcher/as-is/update-sequence.md b/architecture/autodesk-launcher/as-is/update-sequence.md
new file mode 100644
index 0000000..e2e5a6b
--- /dev/null
+++ b/architecture/autodesk-launcher/as-is/update-sequence.md
@@ -0,0 +1,14 @@
+# AS-IS update sequence
+
+```mermaid
+sequenceDiagram
+ participant N as Network
+ participant U as All_Serv_InstallUpdater
+ participant I as All_Serv_Install
+ U->>N: compare MD5/control-sum data
+ U->>U: delete/copy local installer files
+ U->>I: start local installer
+ Note over U,I: Actual deployed updater entrypoint is INFERRED
+```
+
+The updater source performs MD5 comparison and replacement. It was not run and its complete recovery behavior is not established.
diff --git a/architecture/autodesk-launcher/evidence-map.csv b/architecture/autodesk-launcher/evidence-map.csv
new file mode 100644
index 0000000..8b10b6b
--- /dev/null
+++ b/architecture/autodesk-launcher/evidence-map.csv
@@ -0,0 +1,6 @@
+Claim,Evidence,Location,Confidence
+Installer is visible synchronizer,Launcher source audit,migration/audits/launcher-source-architecture/architecture-summary.md,CONFIRMED
+P_Serv_Starter generates NETLOAD LISP,Launcher source audit,migration/audits/launcher-source-architecture/launcher-to-p-rec-annot.md,CONFIRMED
+OrthoLoader reads Settings and loads 20 modules,Legacy loading audit,migration/audits/p-rec-annot-legacy-loading/loading-chain.md,CONFIRMED
+Automatic acaddoc startup,No deployed proof,architecture/autodesk-launcher/as-is/known-unknowns.md,UNKNOWN
+Target local package/atomic activation,Design decision,architecture/autodesk-launcher/adr,ACCEPTED
diff --git a/architecture/autodesk-launcher/target/architecture.md b/architecture/autodesk-launcher/target/architecture.md
new file mode 100644
index 0000000..5d3169d
--- /dev/null
+++ b/architecture/autodesk-launcher/target/architecture.md
@@ -0,0 +1,13 @@
+# Launcher Next target architecture
+
+Launcher Next is a parallel .NET 8 foundation: one visible x64 application, immutable versioned local packages, manifest/hash validation, atomic activation, rollback pointer, explicit dry-run Plant launch preparation and structured local logs. It does not deploy, alter profiles, start AutoCAD or change legacy files in this foundation.
+
+```text
+Launcher.Next.App -> Application orchestration -> Infrastructure adapters
+  -> product discovery (registry abstraction)
+  -> package catalog / local synchronizer / versioned store
+  -> manifest validation / SHA-256
+  -> startup script builder -> Process launcher dry-run
+```
+
+For P_Rec_Annot, one local entry `PRecAnnot.Plant3D2026.dll` replaces legacy `OrthoLoader -> Settings.xml -> 20 NETLOAD` orchestration. Its internal dependencies are CLR dependencies; Autodesk assemblies remain supplied by AutoCAD.
diff --git a/architecture/autodesk-launcher/target/compatibility-matrix.md b/architecture/autodesk-launcher/target/compatibility-matrix.md
new file mode 100644
index 0000000..69a8c4b
--- /dev/null
+++ b/architecture/autodesk-launcher/target/compatibility-matrix.md
@@ -0,0 +1,11 @@
+# Compatibility matrix
+
+| Dimension | Legacy | Next foundation | Pilot decision |
+|---|---|---|---|
+| UI | WinForms installer | WPF shell | parallel |
+| Runtime | .NET Framework 4.7 | .NET 8 x64 | separate EXE |
+| Plugin load | generated multi-NETLOAD | one local NETLOAD | validate first |
+| Package source | network copy | manifest + local cache | no production UNC client yet |
+| Offline | unknown | last valid local version | design policy |
+| Rollback | manual/unknown | previous pointer | foundation tested |
+| AutoCAD version | historical 2019 evidence | discovery for Plant 2026 | require runtime confirmation |
diff --git a/architecture/autodesk-launcher/target/component-model.md b/architecture/autodesk-launcher/target/component-model.md
new file mode 100644
index 0000000..9bb1c40
--- /dev/null
+++ b/architecture/autodesk-launcher/target/component-model.md
@@ -0,0 +1,12 @@
+# Target component model
+
+| Component | Responsibility | Boundary | Side effects |
+|---|---|---|---|
+| Launcher.Next.App | minimal WPF shell and view model | UI only | none until explicit action |
+| Core | contracts, manifest models, validation policy | no WPF/registry/process/filesystem/Autodesk | none |
+| Application | synchronize/activate/prepare workflows | ports only | none directly |
+| Infrastructure | local files, hashes, catalog implementation | filesystem/network behind interfaces | staging/cache writes |
+| Autodesk | registry discovery, script construction, ProcessStartInfo | OS/process boundary | dry-run only in foundation |
+| Observability | redacted JSONL events | local logging | log file write |
+
+Feature flag: `Legacy`, `NextPilot`, `NextPreferred`; default is `Legacy`. No production configuration changes occur without explicit authorization.
diff --git a/architecture/autodesk-launcher/target/local-cache.md b/architecture/autodesk-launcher/target/local-cache.md
new file mode 100644
index 0000000..41da069
--- /dev/null
+++ b/architecture/autodesk-launcher/target/local-cache.md
@@ -0,0 +1,11 @@
+# Local cache
+
+The configurable root defaults by policy to the corporate local support root:
+
+```text
+<SupportRoot>/Launcher/{config,logs,state,staging,rollback}
+<SupportRoot>/Applications/<PackageId>/versions/<version>/
+<SupportRoot>/Applications/<PackageId>/current.json
+```
+
+Keep `current`, `previous` and incomplete `staging` separate. Activated directories are immutable; do not overwrite a DLL used by AutoCAD. A valid cache permits offline use; an invalid or partial staging directory never becomes current.
diff --git a/architecture/autodesk-launcher/target/migration-strategy.md b/architecture/autodesk-launcher/target/migration-strategy.md
new file mode 100644
index 0000000..069a724
--- /dev/null
+++ b/architecture/autodesk-launcher/target/migration-strategy.md
@@ -0,0 +1,9 @@
+# Migration strategy
+
+1. Preserve legacy unchanged and default `LauncherMode=Legacy`.
+2. Pilot an isolated group with `NextPilot`, local cache and one P_Rec entry assembly.
+3. Validate package/hash/rollback and dry-run launch preparation before any runtime use.
+4. Test actual bootstrap only with separate authorization and non-production Plant data.
+5. Move to `NextPreferred` only after operational evidence; retain immediate Legacy fallback.
+
+No AppLoader, registry demand-loading or direct UNC deployment decision is implied by this foundation.
diff --git a/architecture/autodesk-launcher/target/observability.md b/architecture/autodesk-launcher/target/observability.md
new file mode 100644
index 0000000..ff8c397
--- /dev/null
+++ b/architecture/autodesk-launcher/target/observability.md
@@ -0,0 +1,5 @@
+# Observability
+
+Write best-effort JSONL records under `%LOCALAPPDATA%\Promhimproekt\LauncherNext\Logs`. Events: `LauncherStarted`, `ConfigurationLoaded`, `ProductDiscoveryStarted`, `ProductDiscovered`, `CatalogReadStarted`, `CatalogReadCompleted`, `PackageValidationStarted`, `PackageValidationCompleted`, `SynchronizationStarted`, `SynchronizationCompleted`, `ActivationCompleted`, `RollbackStarted`, `RollbackCompleted`, `LaunchPrepared`, `LaunchBlocked`, `LauncherFailed`.
+
+Records exclude user identity, tokens, passwords, full Plant project paths, project numbers and engineering-file content. Logs must never block a launch decision.
diff --git a/architecture/autodesk-launcher/target/package-manifest.md b/architecture/autodesk-launcher/target/package-manifest.md
new file mode 100644
index 0000000..0608973
--- /dev/null
+++ b/architecture/autodesk-launcher/target/package-manifest.md
@@ -0,0 +1,26 @@
+# Package manifest
+
+```json
+{
+  "schemaVersion": 1,
+  "packageId": "P_Rec_Annot",
+  "version": "2026.1.0",
+  "product": "Plant3D",
+  "productYear": 2026,
+  "architecture": "x64",
+  "minimumLauncherVersion": "1.0.0",
+  "compatibleAutoCadSeries": ["R25.1"],
+  "requiredRuntime": ".NET 8",
+  "entryAssembly": "PRecAnnot.Plant3D2026.dll",
+  "files": [{ "path": "PRecAnnot.Plant3D2026.dll", "length": 0, "sha256": "<64 hex>" }],
+  "dependencies": [],
+  "optionalResources": [],
+  "rolloutChannel": "pilot",
+  "disabled": false,
+  "rollbackSafe": true,
+  "releaseNotesReference": "relative-release-notes.md",
+  "startup": { "type": "netload", "command": "PHP_REC_ANNOT" }
+}
+```
+
+Validation rejects absolute/traversal/duplicate paths, missing entry assembly, incompatible product/year/architecture, and Autodesk/Plant managed assemblies (`AcMgd`, `AcDbMgd`, `AcCoreMgd`, `AdWindows`, `PnP*`, `Autodesk.ProcessPower*`). No absolute paths belong in a manifest.
diff --git a/architecture/autodesk-launcher/target/plugin-bootstrap.md b/architecture/autodesk-launcher/target/plugin-bootstrap.md
new file mode 100644
index 0000000..d9f4199
--- /dev/null
+++ b/architecture/autodesk-launcher/target/plugin-bootstrap.md
@@ -0,0 +1,5 @@
+# Plugin bootstrap
+
+Generate a temporary, locally stored startup script only from a validated package root. It contains exactly one escaped `NETLOAD` for the entry assembly and no separate dependency loads. The script is not executed by foundation tests.
+
+`PRecAnnot.Plant3D2026.dll` is the only managed entry. `PRecAnnot.Application`, `PRecAnnot.Core` and allowed third-party libraries resolve as CLR dependencies. Autodesk managed assemblies are neither copied nor included in package manifests; they load from the installed AutoCAD/Plant runtime.
diff --git a/architecture/autodesk-launcher/target/security-model.md b/architecture/autodesk-launcher/target/security-model.md
new file mode 100644
index 0000000..ef8e8f1
--- /dev/null
+++ b/architecture/autodesk-launcher/target/security-model.md
@@ -0,0 +1,9 @@
+# Target security model
+
+- Load managed assemblies only from validated local version directories, never directly from UNC.
+- Hash every packaged file with SHA-256 before activation.
+- Validate package paths against traversal and package-root escape.
+- Forbid Autodesk runtime DLLs in packages.
+- Detect Autodesk installations through a read-only registry abstraction with configuration override for diagnostics.
+- Do not change `TRUSTEDPATHS`, registry, profiles or production deployment without explicit approval.
+- Keep credentials/secrets out of source, manifests and telemetry.
diff --git a/architecture/autodesk-launcher/target/startup-sequence.md b/architecture/autodesk-launcher/target/startup-sequence.md
new file mode 100644
index 0000000..f1a9c69
--- /dev/null
+++ b/architecture/autodesk-launcher/target/startup-sequence.md
@@ -0,0 +1,22 @@
+# Target startup sequence
+
+```mermaid
+sequenceDiagram
+ participant U as User
+ participant L as Launcher Next
+ participant D as Product discovery
+ participant C as Package catalog
+ participant S as Local store
+ participant A as Plant 3D
+ participant P as PRecAnnot entry
+ U->>L: Prepare launch (NextPilot)
+ L->>D: discover installed Plant 3D
+ L->>C: read package manifest when network is available
+ L->>S: stage, hash-validate, activate package atomically
+ L->>L: build one validated NETLOAD startup script
+ L->>A: ProcessStartInfo (explicit profile/script)
+ A->>P: one NETLOAD local PRecAnnot.Plant3D2026.dll
+ P->>A: commands and Ribbon registry
+```
+
+Foundation performs through `LaunchPrepared`; real process start remains dry-run only.
diff --git a/architecture/autodesk-launcher/target/update-and-rollback.md b/architecture/autodesk-launcher/target/update-and-rollback.md
new file mode 100644
index 0000000..35e1e47
--- /dev/null
+++ b/architecture/autodesk-launcher/target/update-and-rollback.md
@@ -0,0 +1,10 @@
+# Atomic update and rollback
+
+1. Read and validate manifest.
+2. Copy/download into a new staging directory with cancellation and bounded parallelism.
+3. Validate file length, SHA-256, required files, entry metadata and forbidden DLLs.
+4. Write local manifest, close streams and rename staging to `versions/<version>`.
+5. Atomically replace `current.json`; preserve prior pointer.
+6. On bootstrap failure, offer rollback by atomically restoring the prior pointer.
+
+Never update an active directory in place. Locked files leave the current version intact and yield a diagnostic status. Network failure uses the last valid local version; when none exists, policy is to launch Plant without the corporate plugin or offer Legacy fallback, never a partial Next package.