Merge branch 'main' of gitea.satstack.dev:pleb/beatsaber-plugin-helper

README.md

@@ -163,9 +163,34 @@ the configured state directory for one command.
 Install assets are currently expected to already exist locally, usually under:
 
 ```text
-<state-dir>/instances/<instance>/downloads/<plugin-id>/
+<state-dir>/cache/downloads/<instance>/<plugin-id>/
 ```
 
+Lock entries may include `download_url`, the exact public zip or DLL URL for the
+locked artifact. The URL is currently audit/recovery metadata; `plan`, `check`,
+and `apply` still use local assets and do not fetch missing downloads
+automatically.
+
+Composite local assets should have an explicit reconstruction recipe checked in
+with the helper. For example, Cinema's external Windows downloader tools are a
+small deterministic bundle rebuilt from upstream executables with:
+
+```sh
+PYTHONPATH=src python -m plugin_helper.recipes.cinema_tools --instance 1.44.1
+```
+
+Use `updates` to audit the version lock against obvious public update sources:
+
+```sh
+PYTHONPATH=src python -m plugin_helper --state-dir .state updates --instance 1.44.1
+```
+
+The command checks GitHub release assets for ordinary repository-backed locks
+and BeatMods verified metadata for `beatmods-*` locks. Patreon and Discord
+paid/private sources are skipped, and local builds, PR builds, failed
+compatibility trials, and manual installs are marked for review instead of being
+treated as routine updates.
+
 ## Beat Saber Data Backups
 
 `backup-userdata` copies the mounted Windows `UserData` folder and Beat Saber