Why

Stabilize the v4 baseline by closing permissive or hidden contracts found during independent audit, restoring App dialog path memory, replacing fragile launcher resolution patches with one statically traceable boundary, and making long validation observable. The test tree must mirror the production tree so public and promotable private Apps can share one ownership model.

What changed

• Preserved existing entrypoints, saved-project formats, scientific formulas, exports, and supported selectors while tightening invalid-input, option, persistence, and status contracts across Apps and +labkit.
• Restored independent last-successful input/output folder memory without overriding valid caller start paths or mutating preferences on cancellation.
• Reworked launcher dispatch around validated static ownership and removed avoidable hidden invocation relationships; repository tests guard remaining deliberate dynamic boundaries.
• Closed App SDK document-conflict, source-binding, logging, archive, native-value, and state-path edge cases.
• Resolved all Code Analyzer findings without suppression and added native progress/heartbeat reporting to test, documentation, code-check, and profiling workflows.
• Reorganized specifications to mirror apps/, +labkit, tools/, labkit_launcher.m, repository policy, and tests/+labkittest; semantic helper and workbench integration contracts now have separate physical owners.
• Strengthened AGENTS policy for develop-only direct pushes, checkpoint reflection, experience compression, and observable long-running validation.
• Updated affected component versions, owning manuals, and the structured cross-component history record. The active migration ledger remains zero-debt and is not retained as release history.

Evidence

matlab -batch buildtool-changedFast
  PASS: 393 exact identities
  384 headless + 9 hidden-GUI; 0 failed, 0 incomplete

matlab -batch buildtool-docsCheck
  PASS: two deterministic renders, 378 generated files each

runCodecheckReport(pwd, OpenReport=false)
  PASS: 1,559 MATLAB files, 0 issues, 0 suppressed

Focused regression after the only aggregate failure
  Thermal facade: 4/4 PASS
  final changedFast then passed in full

Test-catalog/framework focus
  tests/labkittest: 47/47 PASS
  includes compiled-plan execution, deleted-path routing, progress heartbeat,
  ownership coverage, and reset-path probe behavior

Additional focused evidence passed for launcher bootstrap/dispatch, App SDK dialog memory and persistence conflicts, direct semantic helper/source contracts, Curvature and Focus Stack workbench composition, repository architecture, code-check, profiling, and documentation progress output.

Risks and follow-up

• Compatibility: changes are additive or stricter only for previously invalid/ambiguous inputs. Existing project payload versions, source-record shapes, entrypoints, and export schemas are retained.
• Dependencies: no new production dependency, downloaded runtime, or Toolbox requirement.
• Data: the public diff contains synthetic or generic fixtures only; no private App source, repository detail, lab identifier, or local data path is included.
• Manual boundaries: hidden-GUI automation does not prove native dialog appearance, pointer feel, or full operator workflows. Windows dialog path-memory policy is headlessly verified; a developer-led visible end-to-end pass remains a release prerequisite.
• Scientific boundary: formulas, units, defaults, and accepted selectors are preserved; synthetic parity evidence does not replace expert validation on approved laboratory data.

Author confirmation

• The final diff matches the stated scope and contains no unrelated change.
• The evidence above covers required local and manual validation; every remaining unverified boundary is explicit.
• The diff contains only synthetic or generic public data, with no private App details, lab identifiers, local paths, or recognizable sample values.