docs(planning): Atomic Launcher — SearchLauncher × Atomic merge

planning/README.md

@@ -51,6 +51,7 @@ scratch document. When a plan becomes obsolete, delete it.
 | [`content-i18n.md`](./content-i18n.md)                                                           | **Proposal (2026-07-20):** content translations (#1069) as document-level localization — a translation is an ordinary resource with `language` + `translationOf`, drafts/queries/zones/templates compose for free; locale-per-branch rejected (LWW divergence), `TranslationBox` concept dead; field-level `LocalizedText` datatype is the planned second layer for shared-structure fragments (nav labels, feature cards), gated on the primitive-first `Value` reshape. Milestone 11 (headless CMS).                                  |
 
 | [`android-data-reuse.md`](./android-data-reuse.md)                                               | **Draft (2026-07-23):** one Atomic store/agent/Iroh node per Android device — an elected host app owns the store and serves other apps over Binder (ContentProvider/AIDL, on-demand, cert-bound caller identity); commits are the IPC write protocol; canvas gains a client mode and reuses an installed atomic-server. Supersedes the localhost-daemon transport in `on-device-atomic-daemon.md`.                                  |
+| [`atomic-launcher.md`](./atomic-launcher.md)                                                     | **Exploration (2026-08-03):** merge SearchLauncher (Kotlin HOME search + WebView) with Atomic — uniffi host, unified search, quick-create; presentation layers (search rows, favorites, ambient peek, AppWidgets, warm data-browser PWA "Atomic Shell" as first-class apps).                                  |
 | [`index-performance.md`](./index-performance.md)                                                 | **Diagnosis (2026-07-24):** comparative benchmark vs. NextGraph found collection queries costing ~100µs/matching resource. Root cause: every match is fully Loro-decoded plus permission-checked (which itself re-decodes the drive resource) even when only subjects are requested. One fix shipped (redundant snapshot re-export); the structural fix for the permission-check half is `zones.md`'s zone index, not yet built. |
 | [`partial-sync.md`](./partial-sync.md)                                                           | **Proposal (2026-07-31):** replicate part of a drive per device. Absence is currently overloaded ("I lack X" ⇒ "send me X"), so a partial replica gets refilled and never matches the whole-drive hash. Devices declare a positive scope (subtree/zone roots + a blob-bytes axis) plus fill state; enforcement in both bulk reconcile and live fan-out; eviction must not tombstone. Requires keying RBSR by `zone \|\| subject` before `drive-reconciliation.md` Phase 2 builds the tree. |