fix(reconcile): repair a pointer section instead of appending a second one

[ProtocolWarden]

Summary

_ensure_pointer recognised the pointer by heading and _POINTER_PREFIX, so a section already headed Archived whose body lacked the prefix matched neither branch — the loop fell through and appended a second ## Archived beside it.

#53 flagged this and deliberately left it. It is not hypothetical: that PR nearly shipped it. Its first end-to-end fixture wrote the legacy pointer with an ASCII -> instead of the prefix's Unicode →, produced two ## Archived sections, and passed the whole unit suite.

Two ways in:

• an operator writes the heading by hand
• an older run's wording drifts from the constant

The change

Match on heading alone, branch on the body inside:

for i, sec in enumerate(sections):
    if sec.heading != pointer.heading:
        continue
    if _POINTER_PREFIX not in sec.body:
        return sections[:i] + [_merge_pointer_into(sec, pointer)] + sections[i + 1 :]
    if _ABSOLUTE_REF_RE.search(sec.body):
        return sections[:i] + [pointer] + sections[i + 1 :]
    return sections
return sections + [pointer]

Repaired, not replaced. Replacing wholesale would discard whatever prose sits under that heading, and this module goes out of its way elsewhere to preserve an operator's annotations on a portable pointer. So the pointer line is inserted under the heading and the remaining body kept verbatim — which also holds the invariant the caller needs: after a prune, exactly one ## Archived section carrying a correct portable ref.

Testing

488 → 494 passed. The 16 failures are unchanged and identical; test_committed.py / test_signing.py still fail to import for lack of cryptography in this environment (pre-existing, unrelated).

All 6 new tests were mutation-checked by reverting the predicate — worth stating precisely, because two of them did not fail on the first draft. The pre-fix code also preserves the prose and is also stable on re-run; it is just stable at two sections rather than one. Both now assert the section count, which is the property that actually distinguishes the behaviours. A test that passes against the bug it names is worse than no test.

Notes for reviewer

No narrative log entry, following #53's precedent: this repo's .console/log.md is at exactly 400/400, so adding one would trip RC1 and force a prune in order to land a commit about pruning. Custodian ADR 0001 argues rationale belongs in the commit message rather than duplicated into the log.

Left unfixed, deliberately: ContextLifecycle#54 reports a separate defect in the same file — prune --dry-run under-reports, because _retain_recent_log archives unclaimed sections by age that never appear in plan.moves. That is a policy question about what recent_n means, not a predicate bug, so it does not belong in this change.

🤖 Generated with Claude Code