Document and test NFC reconstruction with logical deletions

docs/design_docs/unicode_path_identity.md

@@ -1,7 +1,7 @@
 ---
-date: 2026-10-17
+date: 2026-10-19
 commonlib-version: "0.1.42"
-self-hosted-livesync-version: "1.0.37"
+self-hosted-livesync-version: "1.0.38"
 status: unreleased
 ---
 
@@ -16,8 +16,9 @@ the [Unicode path identity ADR](../adr/2026_10_unicode_path_identity.md).
 Commonlib's [consumer contract](https://github.com/vrtmrz/livesync-commonlib/blob/main/docs/unicode-path-identity.md)
 defines the shared package boundary.
 
-This records an unreleased change after Self-hosted LiveSync `1.0.37`, using the
-published Commonlib `0.1.42` package as an exact dependency.
+NFC identity shipped in Self-hosted LiveSync `1.0.38` with Commonlib `0.1.42`.
+The deletion handling in reconstruction below is an unreleased refinement of
+that baseline.
 
 ## Scope
 
@@ -117,6 +118,16 @@ must resolve the ambiguous names or exclude one file from the synchronisation
 scope, then retry the reconstruction. This check is bounded by the host's
 listing contract and does not imply that every raw physical alias is visible.
 
+For full Rebuild, Standard Fetch, and Fast Fetch, which replace the local
+database, the Metadata enumeration requests conflict information. It excludes
+`deleted: true` documents only when they have no unresolved conflict leaves.
+A deleted winner with any unresolved conflict remains a collision candidate,
+including when the other leaves are also logically deleted. Remote-only
+Rebuild retains logically deleted Metadata and requires stored IDs to match
+the selected identity. Fully tombstoned documents are already absent from
+ordinary enumeration; a still non-deleted local copy remains subject to the
+check until a remote deletion has been replicated.
+
 ## Reconstruction and client operations
 
 Mode changes are never applied by an ordinary Metadata write. In Obsidian, the

docs/recovery.md

@@ -30,6 +30,10 @@ This migration reconstructs the databases from one authoritative Vault. It does
 4. On each remaining client, select **Unicode NFC path identity** (`pathNormalizationVersion: 1`) before fetching. In Obsidian, choose **Reset Synchronisation on This Device**. In the CLI, set the same value in its settings and run `fetch` with `--force --write-settings`.
 5. Confirm that every client uses version `1` and that the expected files are present before resuming synchronisation. Do not reconnect a version `0` client to the migrated database.
 
+Rebuild and both Fetch paths ignore local logical deletions without unresolved conflicts when replacing the local database. Deletion or rename history alone therefore does not block this migration. Fully tombstoned documents are already absent from the Metadata check. Unresolved conflicts and ambiguous current files still require review, even when a conflict's winning revision is logically deleted. Remote-only Rebuild retains its existing ID checks and is not a substitute for the source Rebuild above.
+
+A remote deletion which has not reached this device does not establish that its local Metadata is deleted. Inspect the local state and preserve unsynchronised content before resolving a reported collision. Manual deletion of every database is not a prerequisite for this procedure. Clients already using NFC identity do not need to repeat the migration for this change.
+
 The Inspector's **Repair this Metadata document ID** action repairs one local entry; it is not a bulk migration tool. Use the Rebuild and Fetch procedure above for path identity changes.
 
 This procedure does not establish native macOS or iOS filesystem behaviour. Obsidian's collision checks use the paths exposed by its Vault APIs; see [Unicode path identity](settings.md#unicode-path-identity) for that visibility limit.

docs/settings.md

@@ -1062,7 +1062,7 @@ Version `1` requires a coordinated migration: set it on the source client before
 
 The selected value stays pending through ordinary settings saves and reloads. It becomes active only when the Rebuild or Fetch operation is successfully reserved; cancellation leaves it pending.
 
-Distinct files or Metadata documents which derive the same identity stop reconstruction before either database is reset. This check uses the host's supported file listing; Obsidian checks the paths exposed by its Vault APIs and cannot detect physical aliases hidden by its index. Resolve the duplicate names or synchronisation scope first; Self-hosted LiveSync does not merge them automatically. Case-insensitive handling also applies the existing letter-case rule.
+Distinct files or retained Metadata documents which derive the same identity stop reconstruction before either database is reset. When replacing the local database, Rebuild and Fetch exclude logical deletions without unresolved conflicts; a deleted winner with unresolved conflicts still participates in the check. This check uses the host's supported file listing; Obsidian checks the paths exposed by its Vault APIs and cannot detect physical aliases hidden by its index. Resolve the duplicate names or synchronisation scope first; Self-hosted LiveSync does not merge them automatically. Case-insensitive handling also applies the existing letter-case rule.
 
 ### 4. Compatibility (Internal API Usage)