diff --git a/.console/log.md b/.console/log.md
index 31caa41..78935c6 100644
--- a/.console/log.md
+++ b/.console/log.md
@@ -1,5 +1,11 @@
 # Log
 
+## 2026-06-04 — Console reconciliation: enforce R1/R2
+
+- Confirmed tracked .console/ + docs are leak-free (no scrub-target identifiers) and log.md is under the 400-line R1 budget.
+- Added `audit.reconcile_enforce: true` to .custodian/config.yaml to flip Custodian R1/R2 from dormant to fail-closed (this repo is reconciled + clean).
+- Verified: `cl reconcile check` GREEN; custodian audit yields no R1/R2 findings (only pre-existing B2/W2).
+
 ## 2026-05-21 — Add closing console-context fence to CLAUDE.md
 
 Added <!-- /console-context --> end marker so OperatorConsole only
diff --git a/.custodian/config.yaml b/.custodian/config.yaml
index a68dd51..e453920 100644
--- a/.custodian/config.yaml
+++ b/.custodian/config.yaml
@@ -16,6 +16,10 @@ privacy:
 # Audit: per-detector exclusions
 # ---------------------------------------------------------------------------
 audit:
+  # This repo's .console/ is reconciled + clean (leak-free, log under budget);
+  # flip R1/R2 to fail-closed enforcement per the reconciliation spec §6.
+  reconcile_enforce: true
+
   cross_repo:
     platform_manifest_repo: ../PlatformManifest