chore(memory): LRN-087 + LRN-088 + LRN-077 corrob + BDR-026 incident + journal 2026-07-02

Audit session capitalization: presence-flag ≠ capability (rtk),
token verbosity-beats-cardinality, T6c transient-state green,
copies-of-secrets incident (magic key rotated).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016zA3Qh2Q1QpcGXzXxKeDHR

.claude/memory/journal.md

@@ -295,3 +295,10 @@ rules:
 - /reconcile show-only (claude repo, engine-verified): confronted TODO+registries vs git/fs. Real state = 1 actionable (install-plugins npm harden), 3 blocked-upstream (BLK-001 rtk / BLK-003 darwin / BLK-009 CC #21858, re-test on CC MAJ), 3 deferred-on-trigger, release-decision live (develop 20 ahead of v4.0.0). Engine false-flagged BLK-014 (last-status-wins caught Reference "open" vs Status resolved) — verified merged. "canal d'install" = already decided by BDR-046, NOT open; faunosteo/WARN-manuel = not in this repo.
 - (c) TODO drift fixed: 7 `--help` WON'T-BUILD subtasks `[ ]`→`[-]` (chore/reconcile-todo-drift, 9c02406) → naive open-count 10→3, survivors all genuine deferred-open. Registries left read-only during reconcile (staleness deferred to this capitalize).
 - (a) BLK-013 fix-forward BUILT: install-plugins.sh unconditional npm guard (corepack→distro→fatal), placed after `NODE_OK` short-circuit so node>=22-but-no-npm hosts don't skip it. shellcheck/`bash -n` clean, 1f2c1cc. Capitalize refreshed BLK-013 (NOT built→built), BLK-014 + BDR-046 (pending→merged) via append-only Update blocks. Both branches finished into develop.
+
+## 2026-07-02
+- Fable 5 exhaustive audit (read-only, 5 subagents + real suites): 24 findings — 5 bugs (rtk DEAD silently since .bashrc wipe → [[LRN-087]]; session-start update-check on gone origin/master; run-reconcile T6c parasite path → [[LRN-077]] corrob; doctor 3 false sentinels incl. BDR-019 contradiction), token overhead measured 14.6k/session → [[LRN-088]].
+- 3 lots merged on explicit GO (suites green after each, reconcile 20/20 post-LOT1): bugfix/audit-bugs (rtk absolute-path heal + re-pin ×2, origin/main, T6c, doctor sentinels); feature/audit-hardening (.bak purge, banner ALWAYS_ON derived + graphify label, ok-gated installers, design-hook regex tightened, update-all bun+exclusions, deny 99→113 + rtk read-only allowlist + .env mirrors, cleanup batch, origin/HEAD→main); feature/audit-tokens (pr-review-toolkit OFF −2.2k tok, kept in audit.profile as reactivation channel; 10 descriptions compressed −540 tok).
+- #11 rtk auto-allow DROPPED — permission control back in settings.json (rtk registry was a parallel authority bypassing deny/ask). #10 rules/context7.md deleted (−493 tok; find-docs survives, stable — regen keyed on its absence); faulty examples → upstream issue draft (upstash/context7, gh unauthenticated). plugin-dev uninstalled + dropped from installer.
+- Incidents: magic API key printed into transcript from ~/.claude.json → rotated, [[BDR-026]] update (copies of secrets); gitflow_finish ignores its args (operates on CURRENT branch, lib/gitflow.sh:104) → LOT 3 merged first by mistake, final develop state identical (disjoint hunks) — UX trap noted, not fixed.
+- Residuals (flagged, not built): doctor "Cargo not found (RTK unavailable)" parenthesis now misleading; doctor symlink-check false-warns on dir-level symlinks; doctor token constants stale; find-docs faulty examples ctx7-owned.