@remnic/core 9.44.0 → 9.45.1

package/src/reconcile/manifest.ts

@@ -0,0 +1,278 @@
+import { createHash } from "node:crypto";
+import { inferMemoryStatus } from "../memory-lifecycle-ledger-utils.js";
+import { ContentHashIndex, type ContentHashPathEntry } from "../storage/content-hash-index.js";
+import type { MemoryFrontmatter, MemoryStatus } from "../types.js";
+import { RECALL_FALLBACK_DIRS } from "../utils/category-dir.js";
+import {
+  type ReconcileFileState,
+  type ReconcilePlan,
+  type ReconcilePlanEntry,
+  summarizeReconcilePlan,
+} from "./plan.js";
+
+export const RECONCILE_MANIFEST_FORMAT = "remnic-reconcile-manifest";
+export const RECONCILE_MANIFEST_SCHEMA_VERSION = 1;
+
+export interface ReconcileMemoryIdentity {
+  id: string;
+  category: string;
+  contentHash: string;
+  status: MemoryStatus;
+}
+
+export interface ReconcileManifestFile extends ReconcileFileState {
+  memory?: ReconcileMemoryIdentity;
+}
+
+type ActiveFactManifestFile = ReconcileManifestFile & { memory: ReconcileMemoryIdentity };
+
+export interface ReconcileManifest {
+  format: typeof RECONCILE_MANIFEST_FORMAT;
+  schemaVersion: typeof RECONCILE_MANIFEST_SCHEMA_VERSION;
+  files: ReconcileManifestFile[];
+}
+
+export interface BuildReconcileManifestOptions {
+  files: Iterable<ReconcileFileState>;
+  readFile: (file: ReconcileFileState) => Promise<Buffer | string | null>;
+  cachedFiles?: Iterable<ReconcileManifestFile>;
+}
+
+const SHA256_PATTERN = /^[a-f0-9]{64}$/i;
+const MEMORY_DIRS = new Set(RECALL_FALLBACK_DIRS);
+
+function isMemoryPath(filePath: string): boolean {
+  if (!filePath.endsWith(".md")) return false;
+  const segments = filePath.split("/");
+  let index = 0;
+  if (segments[index] === "cold" || segments[index] === "archive") index += 1;
+  return MEMORY_DIRS.has(segments[index] ?? "");
+}
+
+function parseScalar(value: string | undefined): string | undefined {
+  if (value === undefined) return undefined;
+  const trimmed = value.trim();
+  if (trimmed.length === 0) return undefined;
+  if (trimmed.startsWith('"') && trimmed.endsWith('"')) {
+    try {
+      const parsed = JSON.parse(trimmed) as unknown;
+      return typeof parsed === "string" ? parsed : trimmed;
+    } catch {
+      return trimmed.slice(1, -1).replace(/\\"/g, '"');
+    }
+  }
+  if (trimmed.startsWith("'") && trimmed.endsWith("'")) {
+    return trimmed.slice(1, -1).replace(/''/g, "'");
+  }
+  return trimmed;
+}
+
+function parsedMemoryIdentity(filePath: string, raw: Buffer | string): ReconcileMemoryIdentity | undefined {
+  if (!isMemoryPath(filePath)) return undefined;
+  const match = (Buffer.isBuffer(raw) ? raw.toString("utf8") : raw).match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
+  if (!match) return undefined;
+  const fields = new Map<string, string>();
+  for (const line of match[1].split("\n")) {
+    const separator = line.indexOf(":");
+    if (separator > 0) fields.set(line.slice(0, separator).trim(), line.slice(separator + 1).trim());
+  }
+  const id = parseScalar(fields.get("id"));
+  if (!id) return undefined;
+  const category = parseScalar(fields.get("category")) ?? "fact";
+  const storedHash = parseScalar(fields.get("contentHash"));
+  const contentHash =
+    storedHash && SHA256_PATTERN.test(storedHash)
+      ? storedHash.toLowerCase()
+      : ContentHashIndex.computeHash(match[2].trim());
+  const status = inferMemoryStatus(
+    {
+      status: parseScalar(fields.get("status")) as MemoryStatus | undefined,
+      archivedAt: parseScalar(fields.get("archivedAt")),
+    } as MemoryFrontmatter,
+    filePath
+  );
+  return { id, category, contentHash, status };
+}
+
+export async function buildReconcileManifest(options: BuildReconcileManifestOptions): Promise<ReconcileManifest> {
+  const cachedByPath = new Map<string, ReconcileManifestFile>();
+  for (const cached of options.cachedFiles ?? []) {
+    cachedByPath.set(cached.path, cached);
+  }
+
+  const files: ReconcileManifestFile[] = [];
+  for (const file of options.files) {
+    const cached = cachedByPath.get(file.path);
+    if (cached?.sha256.toLowerCase() === file.sha256.toLowerCase()) {
+      files.push({ ...file, ...(cached.memory ? { memory: cached.memory } : {}) });
+      continue;
+    }
+
+    let raw: Buffer | string | null = null;
+    if (isMemoryPath(file.path)) {
+      try {
+        raw = await options.readFile(file);
+      } catch {
+        raw = null;
+      }
+    }
+    if (raw !== null && createHash("sha256").update(raw).digest("hex") !== file.sha256.toLowerCase()) {
+      raw = null;
+    }
+    const memory = raw === null ? undefined : parsedMemoryIdentity(file.path, raw);
+    files.push({ ...file, ...(memory ? { memory } : {}) });
+  }
+  files.sort((left, right) => (left.path < right.path ? -1 : left.path > right.path ? 1 : 0));
+  return {
+    format: RECONCILE_MANIFEST_FORMAT,
+    schemaVersion: RECONCILE_MANIFEST_SCHEMA_VERSION,
+    files,
+  };
+}
+
+function activeFactByPath(manifest: ReconcileManifest | undefined): Map<string, ActiveFactManifestFile> {
+  const result = new Map<string, ActiveFactManifestFile>();
+  for (const file of manifest?.files ?? []) {
+    if (file.memory?.category === "fact" && file.memory.status === "active") {
+      result.set(file.path, file as ActiveFactManifestFile);
+    }
+  }
+  return result;
+}
+
+function contentHashRows(files: Iterable<ActiveFactManifestFile>): ContentHashPathEntry[] {
+  const rows: ContentHashPathEntry[] = [];
+  for (const file of files) {
+    rows.push({ path: file.path, contentHash: file.memory.contentHash });
+  }
+  return rows;
+}
+
+function comparePlanEntries(left: ReconcilePlanEntry, right: ReconcilePlanEntry): number {
+  if (left.namespace !== right.namespace) return left.namespace < right.namespace ? -1 : 1;
+  return left.path < right.path ? -1 : left.path > right.path ? 1 : 0;
+}
+
+export function collapseActiveFactDuplicates(
+  plan: ReconcilePlan,
+  localManifests: ReadonlyMap<string, ReconcileManifest>,
+  peerManifests: ReadonlyMap<string, ReconcileManifest>
+): ReconcilePlan {
+  const entriesByNamespace = new Map<string, ReconcilePlanEntry[]>();
+  for (const entry of plan.entries) {
+    const entries = entriesByNamespace.get(entry.namespace) ?? [];
+    entries.push({ ...entry });
+    entriesByNamespace.set(entry.namespace, entries);
+  }
+
+  let changed = false;
+  for (const namespace of new Set([...localManifests.keys(), ...peerManifests.keys()])) {
+    const entries = entriesByNamespace.get(namespace) ?? [];
+    const localManifest = localManifests.get(namespace);
+    const peerManifest = peerManifests.get(namespace);
+    const localByPath = activeFactByPath(localManifest);
+    const peerByPath = activeFactByPath(peerManifest);
+    const localFilesByPath = new Map((localManifest?.files ?? []).map((file) => [file.path, file]));
+    const peerFilesByPath = new Map((peerManifest?.files ?? []).map((file) => [file.path, file]));
+    const localByHash = new Map<string, ActiveFactManifestFile[]>();
+    const peerByHash = new Map<string, ActiveFactManifestFile[]>();
+
+    for (const file of localByPath.values()) {
+      const hash = file.memory.contentHash;
+      const bucket = localByHash.get(hash) ?? [];
+      bucket.push(file);
+      localByHash.set(hash, bucket);
+    }
+    for (const file of peerByPath.values()) {
+      const hash = file.memory.contentHash;
+      const bucket = peerByHash.get(hash) ?? [];
+      bucket.push(file);
+      peerByHash.set(hash, bucket);
+    }
+
+    const removed = new Set<ReconcilePlanEntry>();
+    const replacements: ReconcilePlanEntry[] = [];
+    for (const hash of new Set([...localByHash.keys(), ...peerByHash.keys()])) {
+      const localCandidates = (localByHash.get(hash) ?? []).filter((file) => {
+        const opposite = peerFilesByPath.get(file.path);
+        const activeOpposite = peerByPath.get(file.path);
+        return opposite === undefined || activeOpposite?.memory.contentHash === hash;
+      });
+      const peerCandidates = (peerByHash.get(hash) ?? []).filter((file) => {
+        const opposite = localFilesByPath.get(file.path);
+        const activeOpposite = localByPath.get(file.path);
+        return opposite === undefined || activeOpposite?.memory.contentHash === hash;
+      });
+      const localPath = ContentHashIndex.resolvePathByHash(hash, contentHashRows(localCandidates));
+      const peerPath = ContentHashIndex.resolvePathByHash(hash, contentHashRows(peerCandidates));
+
+      if (localPath && peerPath && localPath !== peerPath) {
+        const localFile = localByPath.get(localPath);
+        const peerFile = peerByPath.get(peerPath);
+        if (!localFile || !peerFile) continue;
+        const duplicatePaths = new Set([
+          ...localCandidates.map((file) => file.path),
+          ...peerCandidates.map((file) => file.path),
+        ]);
+        const unsafeEntry = entries.some(
+          (entry) => duplicatePaths.has(entry.path) && (entry.action === "suppress" || entry.action === "conflict")
+        );
+        if (unsafeEntry) continue;
+        for (const entry of entries) {
+          if (
+            duplicatePaths.has(entry.path) &&
+            (entry.action === "pull" || entry.action === "push" || entry.action === "identical")
+          ) {
+            removed.add(entry);
+          }
+        }
+        replacements.push({
+          path: localPath < peerPath ? localPath : peerPath,
+          namespace,
+          action: "identical",
+          reason: "semantic_duplicate",
+          localSha256: localFile.sha256,
+          peerSha256: peerFile.sha256,
+        });
+        changed = true;
+        continue;
+      }
+
+      const sameSideEntries = entries.filter((entry) => {
+        if (localPath && entry.reason === "local_only") {
+          return localCandidates.some((file) => file.path === entry.path);
+        }
+        if (peerPath && entry.reason === "peer_only") {
+          return peerCandidates.some((file) => file.path === entry.path);
+        }
+        return false;
+      });
+      const canonicalPath = localPath ?? peerPath;
+      const hasSharedCanonical = localPath !== undefined && localPath === peerPath;
+      if (!canonicalPath || sameSideEntries.length === 0 || (!hasSharedCanonical && sameSideEntries.length < 2)) {
+        continue;
+      }
+      for (const entry of sameSideEntries) {
+        if (entry.path !== canonicalPath) {
+          removed.add(entry);
+          changed = true;
+        }
+      }
+    }
+
+    if (removed.size > 0 || replacements.length > 0) {
+      entriesByNamespace.set(
+        namespace,
+        [...entries.filter((entry) => !removed.has(entry)), ...replacements].sort(comparePlanEntries)
+      );
+    }
+  }
+
+  if (!changed) return plan;
+  const entries = [...entriesByNamespace.values()].flat().sort(comparePlanEntries);
+  return {
+    entries,
+    byNamespace: summarizeReconcilePlan(entries),
+    converged: entries.every((entry) => entry.action === "identical"),
+  };
+}

package/src/reconcile/plan.test.ts

@@ -60,7 +60,7 @@ test("a bootstrap merge moves unique data both ways and deletes nothing", () =>
   );
 });
 
-test("manual is the default policy: a both-modified path is reported, never auto-picked", () => {
+test("newest-wins is the default policy", () => {
   const entries = planNamespaceReconciliation({
     namespace: "default",
     local: [file("facts/a.md", "local", 2000)],
@@ -69,7 +69,7 @@ test("manual is the default policy: a both-modified path is reported, never auto
   const conflict = entryFor(entries, "facts/a.md");
   assert.equal(conflict.action, "conflict");
   assert.equal(conflict.reason, "both_modified");
-  assert.equal(conflict.resolution, "unresolved", "equally authoritative sides must not be settled by default");
+  assert.equal(conflict.resolution, "local-wins");
 });
 
 test("newest-wins picks the later side by mtime", () => {
@@ -101,17 +101,6 @@ test("newest-wins degrades to keeping both when the order is not decidable", ()
   assert.equal(entryFor(entries, "facts/tied.md").resolution, "supersede-link");
 });
 
-test("keep-both never designates a loser", () => {
-  const entries = planNamespaceReconciliation(
-    {
-      namespace: "default",
-      local: [file("facts/a.md", "local", 2000)],
-      peer: [file("facts/a.md", "peer", 1000)],
-    },
-    { conflictPolicy: "keep-both" },
-  );
-  assert.equal(entryFor(entries, "facts/a.md").resolution, "supersede-link");
-});
 
 test("a base turns a one-sided change back into an ordinary transfer", () => {
   const base = [file("facts/a.md", "v1"), file("facts/b.md", "v1")];
@@ -200,6 +189,41 @@ test("delete-versus-modify stays a conflict in both directions", () => {
   assert.equal(peerEdited.resolution, "unresolved");
 });
 
+test("newest-wins compares delete revision times with surviving modifications", () => {
+  const entries = planNamespaceReconciliation(
+    {
+      namespace: "default",
+      local: [
+        file("facts/local-modification-wins.md", "local-v2", 4000),
+        file("facts/peer-deletion-wins.md", "local-v2", 2000),
+      ],
+      peer: [
+        file("facts/peer-modification-wins.md", "peer-v2", 4000),
+        file("facts/local-deletion-wins.md", "peer-v2", 2000),
+      ],
+      base: [
+        file("facts/local-modification-wins.md", "v1"),
+        file("facts/peer-deletion-wins.md", "v1"),
+        file("facts/peer-modification-wins.md", "v1"),
+        file("facts/local-deletion-wins.md", "v1"),
+      ],
+      localDeletionMtimeMs: new Map([
+        ["facts/peer-modification-wins.md", 3000],
+        ["facts/local-deletion-wins.md", 3000],
+      ]),
+      peerDeletionMtimeMs: new Map([
+        ["facts/local-modification-wins.md", 3000],
+        ["facts/peer-deletion-wins.md", 3000],
+      ]),
+    },
+    { conflictPolicy: "newest-wins" },
+  );
+  assert.equal(entryFor(entries, "facts/local-modification-wins.md").resolution, "local-wins");
+  assert.equal(entryFor(entries, "facts/peer-deletion-wins.md").resolution, "peer-wins");
+  assert.equal(entryFor(entries, "facts/peer-modification-wins.md").resolution, "peer-wins");
+  assert.equal(entryFor(entries, "facts/local-deletion-wins.md").resolution, "local-wins");
+});
+
 test("namespaces are planned independently and reported separately", () => {
   const plan = planReconciliation([
     { namespace: "alpha", local: [file("facts/a.md", "x")], peer: [] },
@@ -774,29 +798,6 @@ test("Win32-aliasing path segments are rejected", () => {
   }
 });
 
-test("a supersede link names the newer revision", () => {
-  // Without a direction transport must re-derive it or guess which side is
-  // linked as superseding the other.
-  const newerPeer = planNamespaceReconciliation(
-    {
-      namespace: "default",
-      local: [file("facts/a.md", "local", 1000)],
-      peer: [file("facts/a.md", "peer", 2000)],
-    },
-    { conflictPolicy: "keep-both" },
-  );
-  assert.equal(entryFor(newerPeer, "facts/a.md").newerSide, "peer");
-
-  const newerLocal = planNamespaceReconciliation(
-    {
-      namespace: "default",
-      local: [file("facts/a.md", "local", 2000)],
-      peer: [file("facts/a.md", "peer", 1000)],
-    },
-    { conflictPolicy: "keep-both" },
-  );
-  assert.equal(entryFor(newerLocal, "facts/a.md").newerSide, "local");
-});
 
 test("an unorderable supersede link says so instead of picking a side", () => {
   for (const pair of [
@@ -805,11 +806,10 @@ test("an unorderable supersede link says so instead of picking a side", () => {
   ] as const) {
     const entries = planNamespaceReconciliation(
       { namespace: "default", local: [pair[0]], peer: [pair[1]] },
-      { conflictPolicy: "keep-both" },
+      { conflictPolicy: "newest-wins" },
     );
     const entry = entryFor(entries, "facts/a.md");
     assert.equal(entry.resolution, "supersede-link");
-    assert.equal(entry.newerSide, undefined, "an unordered link must be visibly unordered");
   }
 });
 
@@ -845,25 +845,13 @@ test("a directionless supersede link is reported as unresolved", () => {
       local: [file("facts/a.md", "local", 5000)],
       peer: [file("facts/a.md", "peer", 5000)],
     },
-    { conflictPolicy: "keep-both" },
+    { conflictPolicy: "newest-wins" },
   );
-  assert.equal(entryFor(entries, "facts/a.md").newerSide, undefined);
   assert.deepEqual(summarizeReconcilePlan(entries), [
     { namespace: "default", pull: 0, push: 0, identical: 0, conflict: 1, suppress: 0, unresolved: 1 },
   ]);
 });
 
-test("an ordered supersede link is not counted as unresolved", () => {
-  const entries = planNamespaceReconciliation(
-    {
-      namespace: "default",
-      local: [file("facts/a.md", "local", 1000)],
-      peer: [file("facts/a.md", "peer", 2000)],
-    },
-    { conflictPolicy: "keep-both" },
-  );
-  assert.equal(summarizeReconcilePlan(entries)[0]?.unresolved, 0);
-});
 
 test("superscript COM and LPT device aliases are rejected", () => {
   for (const bad of ["facts/COM\u00b9.txt", "facts/LPT\u00b2", "facts/com\u00b3.md"]) {
@@ -926,7 +914,7 @@ test("an empty namespace list still validates its options", () => {
       `options ${Object.prototype.toString.call(bad)}`,
     );
   }
-  assert.equal(planReconciliation([], { conflictPolicy: "keep-both" }).converged, true);
+  assert.equal(planReconciliation([], { conflictPolicy: "manual" }).converged, true);
 });
 
 test("sharp-S aliases fold together", () => {

package/src/reconcile/plan.ts

@@ -2,6 +2,11 @@ import { normalizeNamespaceIdentity } from "../namespaces/identity.js";
 import { OFFLINE_SYNC_MAX_MTIME_MS } from "../offline-sync.js";
 import { validateArchiveRelativePath } from "../transfer/fs-utils.js";
 import type { OfflineSyncFileState } from "../offline-sync.js";
+import {
+  CONVERGE_CONFLICT_POLICIES,
+  DEFAULT_CONVERGE_CONFLICT_POLICY,
+} from "../converge-config.js";
+import type { ConvergeConflictPolicy } from "../types.js";
 
 /**
  * Bootstrap reconciliation planner for two peer daemons whose corpora have
@@ -24,21 +29,11 @@ import type { OfflineSyncFileState } from "../offline-sync.js";
 /** Which way a path must move for the two corpora to agree. */
 export type ReconcileAction = "pull" | "push" | "identical" | "conflict" | "suppress";
 
-/**
- * How a path present on BOTH sides with different content is settled.
- *
- * `manual` is the safe default: on a bootstrap merge the two sides are equally
- * authoritative, so silently picking one is data loss with extra steps. An
- * operator opts into an automatic rule once they know the shape of their split.
- */
-export type ReconcileConflictPolicy = "manual" | "newest-wins" | "keep-both";
-
 /**
  * What the planner decided for a conflicting path.
- *
- * `keep-both` never overwrites: the older side is retained and linked as
- * superseded by the newer one, which is the only resolution that cannot lose a
- * fact neither corpus has seen.
+ * `supersede-link` records that both revisions need durable preservation when
+ * timestamps cannot safely select a winner. Apply must stop until transport
+ * can assign distinct durable identities to both revisions.
  */
 export type ReconcileResolution = "local-wins" | "peer-wins" | "supersede-link" | "unresolved";
 
@@ -61,15 +56,6 @@ export interface ReconcilePlanEntry {
    * delete the live copy instead of the retracted one.
    */
   suppressSide?: "local" | "peer" | "both";
-  /**
-   * Which revision is newer, set only for a `supersede-link` resolution.
-   *
-   * The contract is that the older revision is linked as superseded by the
-   * newer one, so transport needs the direction. Absent when the timestamps
-   * cannot order the two - which is exactly when `newest-wins` degrades to
-   * `supersede-link` - and the link direction is then an operator decision.
-   */
-  newerSide?: "local" | "peer";
 }
 
 export type ReconcileReason =
@@ -79,6 +65,7 @@ export type ReconcileReason =
   | "peer_changed"
   | "local_changed"
   | "same_content"
+  | "semantic_duplicate"
   | "both_modified"
   | "peer_deleted"
   | "local_deleted"
@@ -130,6 +117,14 @@ export interface ReconcileNamespaceInput {
    * read as "never seen" rather than "deleted".
    */
   base?: Iterable<ReconcileFileState>;
+  /**
+   * Revision timestamps for paths deleted locally since the base cursor.
+   * A deletion is a revision and must carry a comparable time for
+   * `newest-wins`; absence alone has no timestamp.
+   */
+  localDeletionMtimeMs?: ReadonlyMap<string, number>;
+  /** Revision timestamps for paths deleted by the peer since the base cursor. */
+  peerDeletionMtimeMs?: ReadonlyMap<string, number>;
   /**
    * Digests of FILES this side has retracted, in the same form as
    * `ReconcileFileState.sha256` — a hash of the serialized file.
@@ -162,7 +157,7 @@ export interface ReconcileNamespaceInput {
 }
 
 export interface ReconcileOptions {
-  conflictPolicy?: ReconcileConflictPolicy;
+  conflictPolicy?: ConvergeConflictPolicy;
 }
 
 /**
@@ -472,13 +467,11 @@ function indexDigestsByPath(
   return index;
 }
 
-const RECONCILE_CONFLICT_POLICIES: readonly ReconcileConflictPolicy[] = ["manual", "newest-wins", "keep-both"];
-
-function assertConflictPolicy(value: ReconcileConflictPolicy | undefined): ReconcileConflictPolicy {
-  if (value === undefined) return "manual";
-  if (!RECONCILE_CONFLICT_POLICIES.includes(value)) {
+function assertConflictPolicy(value: ConvergeConflictPolicy | undefined): ConvergeConflictPolicy {
+  if (value === undefined) return DEFAULT_CONVERGE_CONFLICT_POLICY;
+  if (!CONVERGE_CONFLICT_POLICIES.includes(value)) {
     throw new ReconcilePlanInputError(
-      `reconcile: unknown conflictPolicy ${JSON.stringify(value)}; expected one of ${RECONCILE_CONFLICT_POLICIES.join(", ")}`,
+      `reconcile: unknown conflictPolicy ${JSON.stringify(value)}; expected one of ${CONVERGE_CONFLICT_POLICIES.join(", ")}`,
     );
   }
   return value;
@@ -496,36 +489,42 @@ function compareEntries(a: ReconcilePlanEntry, b: ReconcilePlanEntry): number {
   return 0;
 }
 
-/**
- * Direction for a supersede link, when the timestamps can order the pair.
- * Omitted otherwise so an unordered link is visibly unordered rather than
- * silently defaulted to one side.
- */
-function newerSideOf(
-  local: ReconcileFileState,
-  peer: ReconcileFileState,
-): { newerSide?: "local" | "peer" } {
-  const localMs = local.mtimeMs;
-  const peerMs = peer.mtimeMs;
-  if (typeof localMs !== "number" || typeof peerMs !== "number" || localMs === peerMs) return {};
-  return { newerSide: localMs > peerMs ? "local" : "peer" };
-}
 
 function resolveConflict(
-  policy: ReconcileConflictPolicy,
-  local: ReconcileFileState,
-  peer: ReconcileFileState,
+  policy: ConvergeConflictPolicy,
+  localMtimeMs: number | undefined,
+  peerMtimeMs: number | undefined,
+  missingTimestampResolution: ReconcileResolution,
 ): ReconcileResolution {
-  if (policy === "keep-both") return "supersede-link";
   if (policy !== "newest-wins") return "unresolved";
-  const localMs = typeof local.mtimeMs === "number" && Number.isFinite(local.mtimeMs) ? local.mtimeMs : null;
-  const peerMs = typeof peer.mtimeMs === "number" && Number.isFinite(peer.mtimeMs) ? peer.mtimeMs : null;
-  // Without a usable timestamp on both sides "newest" is not decidable, and a
-  // coin flip here silently discards one side's history. Fall back to keeping
-  // both rather than inventing an order.
-  if (localMs === null || peerMs === null) return "supersede-link";
-  if (localMs === peerMs) return "supersede-link";
-  return localMs > peerMs ? "local-wins" : "peer-wins";
+  if (localMtimeMs === undefined || peerMtimeMs === undefined || localMtimeMs === peerMtimeMs) {
+    return missingTimestampResolution;
+  }
+  return localMtimeMs > peerMtimeMs ? "local-wins" : "peer-wins";
+}
+
+function parseDeletionMtimes(
+  value: ReadonlyMap<string, number> | undefined,
+  side: string,
+  namespace: string,
+): ReadonlyMap<string, number> {
+  if (value === undefined) return new Map();
+  if (!(value instanceof Map)) {
+    throw new ReconcilePlanInputError(
+      `reconcile: ${side} deletion mtimes for namespace ${namespace} must be a Map`,
+    );
+  }
+  const parsed = new Map<string, number>();
+  for (const [path, mtimeMs] of value) {
+    try {
+      validateArchiveRelativePath(path, `reconcile: ${side} deletion mtimes for namespace ${namespace}`);
+    } catch (err) {
+      throw new ReconcilePlanInputError(err instanceof Error ? err.message : String(err));
+    }
+    assertPortablePathSegments(path, side, namespace);
+    parsed.set(path, assertMtimeMs(mtimeMs, `${side} deletion for namespace ${namespace} entry ${path}`));
+  }
+  return parsed;
 }
 
 /**
@@ -571,6 +570,8 @@ export function planNamespaceReconciliation(
     namespace,
     "peerTombstonedFileSha256",
   );
+  const localDeletionMtimeMs = parseDeletionMtimes(input.localDeletionMtimeMs, "local", namespace);
+  const peerDeletionMtimeMs = parseDeletionMtimes(input.peerDeletionMtimeMs, "peer", namespace);
   const entries: ReconcilePlanEntry[] = [];
 
   // Path -> digest only, never the file objects: enough to make the stream
@@ -638,7 +639,14 @@ export function planNamespaceReconciliation(
           reason: baseSha256 === localFile.sha256 ? "peer_deleted" : "local_modified_peer_deleted",
           localSha256: localFile.sha256,
           baseSha256,
-          resolution: "unresolved",
+          resolution: baseSha256 === localFile.sha256
+            ? "unresolved"
+            : resolveConflict(
+                policy,
+                localFile.mtimeMs,
+                peerDeletionMtimeMs.get(path),
+                "unresolved",
+              ),
         });
         continue;
       }
@@ -689,7 +697,12 @@ export function planNamespaceReconciliation(
       });
       continue;
     }
-    const resolution = resolveConflict(policy, localFile, peerFile);
+    const resolution = resolveConflict(
+      policy,
+      localFile.mtimeMs,
+      peerFile.mtimeMs,
+      "supersede-link",
+    );
     entries.push({
       path,
       namespace,
@@ -699,7 +712,6 @@ export function planNamespaceReconciliation(
       peerSha256: peerFile.sha256,
       ...(baseSha256 === undefined ? {} : { baseSha256 }),
       resolution,
-      ...(resolution === "supersede-link" ? newerSideOf(localFile, peerFile) : {}),
     });
   }
 
@@ -731,7 +743,14 @@ export function planNamespaceReconciliation(
         reason: baseSha256 === peerFile.sha256 ? "local_deleted" : "local_deleted_peer_modified",
         peerSha256: peerFile.sha256,
         baseSha256,
-        resolution: "unresolved",
+        resolution: baseSha256 === peerFile.sha256
+          ? "unresolved"
+          : resolveConflict(
+              policy,
+              localDeletionMtimeMs.get(path),
+              peerFile.mtimeMs,
+              "unresolved",
+            ),
       });
       continue;
     }
@@ -757,12 +776,9 @@ export function summarizeReconcilePlan(entries: readonly ReconcilePlanEntry[]):
       byNamespace.set(entry.namespace, report);
     }
     report[entry.action] += 1;
-    // A supersede link with no `newerSide` could not be ordered, and the link
-    // direction is then an operator decision - so it counts as unresolved even
-    // though the policy nominally settled it.
     const needsOperator =
       entry.resolution === "unresolved"
-      || (entry.resolution === "supersede-link" && entry.newerSide === undefined);
+      || entry.resolution === "supersede-link";
     if (entry.action === "conflict" && needsOperator) report.unresolved += 1;
   }
   return [...byNamespace.values()].sort((a, b) => (a.namespace === b.namespace ? 0 : a.namespace < b.namespace ? -1 : 1));