fix: enforce lifecycle and desktop launch boundaries - #225

Outcome

Normal desktop launches now preserve the tracked running instance. Logs attach without rebuilding or stopping it; replacement requires explicit --restart and stops if the owner does not exit.

Lifecycle checks reject new implementation covered only by unchanged historical approval, differing evidence for the same acceptance criterion, and unfinished placeholders. Sequential draft stages remain valid without granting implementation or release approval. Identical historical evidence is deduplicated; one historical record combines both original descriptions without changing its outcome.

The accompanying scaffold cleanup narrows Sites and lifecycle-skill triggers, moves the complete profile contract out of always-on instructions, and removes duplicate handoff checks. Ponytail and production approval boundaries remain unchanged.

Canonical change bundles

• docs/sdlc/changes/2026-09-07-enforce-lifecycle-and-launch-boundaries/ — schema 3, medium risk.
• docs/sdlc/changes/2026-09-07-astra-scaffold-cleanup/ — schema 3, low risk.
• Intent, Spec and Plan: accepted by Chen Li through the explicit audit-implementation and repair requests; each Plan lists its affected paths.
• Verification: passed, owner verification by Codex on 2026-09-07.

Verification

• 14 tests / 106 assertions passed across Gate, devflow and launcher tests.
• Existing Core Sites production-boundary regression passed.
• Documentation, full lifecycle and worktree Gates passed; branch Gate checked against origin/main.
• Shell syntax and diff whitespace checks passed.
• Acceptance mappings, verdict and residual risks are recorded in both verification files.
• No rendered UI changes. Launcher tests execute the shell entrypoint with mocked process/build/log operations in disposable directories; devflow tests also use temporary repositories.

Review and release

• The launcher guard covers its tracked owner, not race-free data-directory ownership across worktrees. Native OS locking and complete multi-instance profiles remain outside this change.
• Natural-language routing was not evaluated with live model tasks.
• Rollback: revert this PR; no application data migration is involved.
• Release target: none. PR creation is authorized; merge and release approval remain pending.