fix(core): keep launchd service logs outside protected Downloads

docs/runbooks/MISSION_CORE_LOCAL_SERVICE_RECOVERY.md

@@ -151,3 +151,21 @@ and PGID `42895` produced a new LaunchAgent PID `42942` and exact health in
 operator-station evidence only. An onboard Linux deployment must express the
 same contract in its init system and pass its own power-loss, crash, hang and
 durable-state reconciliation qualification.
+
+## Startup journals outside Downloads
+
+Launch-time stdout/stderr now live in
+`~/Library/Logs/NODE.DC/MissionCore/k1link-serve-launchd.log`.
+The application's own evidence and watchdog journals remain in their configured
+private data directory. launchd/xpcproxy opens stdout before application folder
+permissions apply; putting this startup journal in a Downloads checkout caused
+EX_CONFIG/78 after the 22 September restart. Do not broaden privacy permissions
+or start a duplicate backend to mask this failure.
+
+The normal hash-bound Core plan/apply prepares this private log. For the two
+existing Worker SSH declarations, use `scripts/migrate_worker_tunnel_logs.py`
+`plan observatory` / `plan gaussian`, review hashes, then `apply` with the two
+`--expected-…-sha256` arguments. The migration changes only stdout/stderr paths,
+preserves every SSH option, retains a backup and checks a stable exact PID.
+Confirm Worker registration in the Core catalog after tunnel recovery.
+See `docs/audits/2026-09-22-core-launch-recovery.md` for the observed incident.