chore(console): reconcile the June work that now has docs

[ProtocolWarden]

The first cl reconcile prune --apply this repo has ever had. The workflow was unrunnable here until ContextLifecycle #52 gave the lock an msvcrt backend — reconcile_lock raised on any non-POSIX host, which is why this log kept being hand-trimmed instead of reconciled.

Pairs with PrivateManifest#1, which carries the archived sections. Merge that one too, or the pointer in this log leads nowhere.

What moved

Six sections → PrivateManifest/archive/console/Custodian/log-2026-08-03.md:

• feat: INJ1 prompt-injection signature detector
• feat(DC10): claims-integrated-while-deferring detector (opt-in)
• fix(doctor): register d12_baseline as a known audit key
• feat(D12): baseline ratchet (audit.d12_baseline)
• D12 ships OPT-IN (default-off) — was red-walling consumers
• D12 precision: skip pytest_* plugin hooks (FP class)

Exactly the work #68 documented. The DOC GAP gate holds the rest back, correctly — pattern-collision masking, the orphan-scaffold cleanup and the --only gate still have no durable doc, so they stay partial and stay in the log.

The --recent flag matters more than it looks

Ran with --recent 20, not the default 10. At 10, prune archives claimed sections plus every unclaimed section past the tenth, purely by age — so the recency rule silently outranks the DOC GAP gate and would have archived exactly the undocumented work the gate had just declined to release.

Worth knowing before anyone runs this with defaults.

Verification

• No content lost — diffed every non-blank line of the pre-prune log; all present in either the trimmed log or the archive
• Idempotent — re-running prune reports nothing to archive; post-prune check is GREEN
• .console/log.md 399 → 346, then 371 with this entry — RC1 clear
• Audit 0 findings

One wart

CHANGELOG lines are generated from worksheet titles, and those titles are built from tokens unique to each log heading rather than written as prose. Hence ships default red walling consumers was. Legible, not elegant — flagging it since those lines are durable.

🤖 Generated with Claude Code

[ProtocolWarden]

Review finding, fixed in-place before merge.

cl reconcile prune writes the archive's absolute local path into the pointer section (prune.py:329 — _pointer_section interpolates the full archive_file). On this machine that produced:

_Archived completed history → `C:\Users\<name>\Documents\GitHub\PrivateManifest\...`_

— a home directory and a real name, about to land in a public repo, and meaningless on any other host. Verified origin/main has no absolute paths today, so this commit would have been the first.

Replaced with the spec's own <private-manifest>/... form, which is what boundary rule I2 requires anyway (the private repo is resolved at runtime, never hardcoded).

Safe to hand-edit: _ensure_pointer is idempotent on the heading plus the _Archived completed history → prefix, not on the path — confirmed by re-running prune, which still reports nothing to archive.

The generator bug is ContextLifecycle's and is not fixed here — it will reproduce on the next prune in any repo.