Expose NFC path identity across supported transports

docs/adr/2026_10_unicode_path_identity.md

@@ -13,6 +13,10 @@ Accepted on 2026-10-17. Unicode NFC path identity was released in Self-hosted
 LiveSync 1.0.38 with Commonlib 0.1.42. Local validation evidence and platform
 limits are recorded in the design document.
 
+The maintained design now also describes an unreleased Journal and P2P
+extension and the move to General Settings. The decision below retains the
+initial CouchDB support boundary and original acceptance date.
+
 ## Context
 
 Self-hosted LiveSync derives normal-file Metadata document IDs from Vault paths.

docs/design_docs/unicode_path_identity.md

@@ -22,14 +22,18 @@ and is included in current Commonlib `0.2.2`, used by Self-hosted LiveSync
 `1.0.42`. This later handling is distinct from the initial NFC identity
 release.
 
+An unreleased extension adds Journal and P2P for the same maintained CLI and
+Obsidian hosts, and moves the setting to General Settings. The original dates
+and reviewed versions above remain the historical baseline.
+
 ## Scope
 
 | Area | Contract |
 | --- | --- |
 | Logical identity | Version `1` uses NFC for Metadata ID and path comparison keys. Existing case handling remains a separate rule. Missing and `0` retain legacy behaviour. |
 | Stored paths and content | Keep the spelling in `Metadata.path` and existing physical Vault names. NFC does not change Chunk IDs or content. |
-| Initial hosts and remote | Support CLI and Obsidian with CouchDB. |
-| Other transports | Journal and P2P reject version `1`; Direct file access refuses a remote declaring the NFC feature. Other host adapters remain outside the support matrix. |
+| Maintained hosts and transports | CLI and Obsidian with CouchDB; Journal and P2P are added by the unreleased extension. |
+| Other consumers | Direct file access refuses a remote declaring the NFC feature. Other host adapters remain outside the support matrix. |
 | Migration | Rebuild both databases from one complete authoritative Vault, then Fetch each remaining client. Do not rewrite IDs or merge histories in place. |
 
 ## Path identity contract
@@ -133,8 +137,8 @@ check until a remote deletion has been replicated.
 ## Reconstruction and client operations
 
 Mode changes are never applied by an ordinary Metadata write. In Obsidian, the
-Advanced page offers **Legacy path identity** (`0`) and **Unicode NFC path
-identity** (`1`) for CouchDB. A changed `pathNormalizationVersion` remains
+General Settings → **File identity** offers **Legacy path identity** (`0`)
+and **Unicode NFC path identity** (`1`) independently of the selected transport. A changed `pathNormalizationVersion` remains
 pending through ordinary settings saves, the settings-only Apply fallback, and
 reload. It becomes active only after the existing Rebuild or Fetch operation
 has been successfully reserved; cancellation or failed reservation leaves it
@@ -144,7 +148,8 @@ the settings-only fallback is not offered.
 The [user migration procedure](../recovery.md#migrate-to-unicode-nfc-path-identity)
 owns the operational sequence: updated and stopped clients, a complete backed-up
 authoritative Vault, source Rebuild, then Fetch on each remaining client. The
-source operation reconstructs both databases; a receiving client's Fetch
+source operation reconstructs both databases for CouchDB and Journal. With
+P2P, it reconstructs only the source database. A receiving client's Fetch
 replaces only its local database. The [CLI guide](../../src/apps/cli/README.md)
 provides the equivalent `rebuild` and `fetch` commands.
 
@@ -190,11 +195,48 @@ updates and deletions.
 | --- | --- | --- |
 | CLI with CouchDB | Supported with legacy identity. | Supported with NFC path resolution. |
 | Obsidian with CouchDB | Supported with legacy identity. | Supported with NFC path resolution. |
-| Journal or P2P | Existing behaviour. | Rejected. |
+| CLI or Obsidian with Journal | Existing behaviour. | Added by the unreleased extension; Rebuild remote journals and Fetch other devices. |
+| CLI or Obsidian with P2P | Existing behaviour. | Added by the unreleased extension; update and migrate every peer. |
 | Direct file access | Existing behaviour. | Refuses a remote requiring `nfc-path-identity-v1`. |
 | Other host adapters, including WebApp | Existing behaviour, subject to their existing support. | Outside the initial support matrix until physical-path handling is verified. |
 | Older client without this feature | Can use a legacy database. | Cannot join a database declaring `nfc-path-identity-v1`. |
 
+## Journal and P2P extension
+
+The transport moves the Metadata IDs already generated in the local database;
+it does not derive a second remote ID. Journal uses its existing compatibility
+range with NFC value `4`, plus a required path-version comparison. A legacy
+client with ordinary version checking cannot join the rebuilt Journal. The
+explicit version override in older clients remains outside this guarantee.
+Journal refuses to initialise NFC compatibility when journal objects exist
+without their milestone.
+
+Journal shares one read-only identity assessment across ordinary admission,
+Fetch before local reset, and ordinary milestone updates. It checks stored
+node ranges even when a Rebuild lock has retired the previous accepted nodes.
+Rebuild locks the existing milestone for its source node while retaining an
+existing compatibility range, and declares the replacement identity only after
+the remote journals have
+been deleted. If the milestone is missing, the pre-reset lock does not create
+one over the existing journals. A failed or interrupted reset therefore keeps
+the old identity or the missing declaration.
+
+P2P compares the effective path version through its existing Tweak exchange,
+checks local database identity, and reads the peer version document before
+replication. Fresh control-only databases can declare the existing NFC feature.
+Every participating peer must be updated and migrated; this is not a new
+authentication protocol for already deployed clients.
+
+The existing Rebuild and Fetch paths own migration and state reset. Journal
+reconstructs the local database and remote objects; P2P Rebuild reconstructs
+only the source database. Other devices Fetch the source. Local reset clears
+Journal KV checkpoints, while P2P uses its existing source mark and target
+checkpoint. No new migration store, checkpoint format, or persistent admission
+state is added. An explicit Journal bucket reset also clears the existing
+transfer checkpoint when the bucket is already empty, so a remote-only Rebuild
+resends the complete local database. P2P retains its existing peer selection
+during Fetch.
+
 ## Verification contract and limits
 
 The implementation acceptance matrix covers:
@@ -211,8 +253,9 @@ The implementation acceptance matrix covers:
 - refusal to write when an existing legacy database has Metadata, refusal of
   version-`0` clients against an NFC database, and enforcement when ordinary
   mismatch warnings are disabled;
-- URI round trips, checkpoint invalidation across path versions, and transport
-  rejection for Journal, P2P, and Direct file access;
+- URI round trips, checkpoint invalidation across path versions, and
+  rejection for Direct file access; Journal and P2P acceptance and identity
+  mismatch checks belong to the unreleased extension;
 - refusal for ambiguous file or parent-directory candidates before local or
   remote reset, preserving both databases on rejection, within the paths
   returned by each host's supported listing; and
@@ -251,6 +294,38 @@ Streaming Fast Fetch. Fast Fetch removed the obsolete Metadata and retained
 the current NFC document, its active state, and its stored path. The existing
 content, creation-time, physical-name, update, and deletion checks also passed.
 
+
+### Unreleased Journal and P2P validation
+
+The extension was checked on Linux with a locally packed Commonlib `0.2.3`
+candidate and real Obsidian `1.12.7`. Publication remains pending. The checks
+covered:
+
+- real S3-compatible Journal transfer with and without E2EE and Path
+  Obfuscation, including restart, logical rename and deletion, both conflict
+  leaves and their revision ancestry, and a full resend after bucket reset;
+- real Obsidian and CLI Journal round trips with plain IDs and independent
+  encrypted IDs: Standard Fetch, identical Metadata IDs and Chunk content,
+  retention of a pre-existing NFD physical name, edits after CLI process
+  restart, and deletion reflected back into Obsidian; and
+- real CLI P2P peers in legacy mode and NFC mode, with and without encryption
+  in NFC mode: canonical path reads, incompatible-peer refusal, reverse edits
+  after restart, retained original revision content, logical rename, and
+  deletion. Existing automatic-host, adapter-replacement, and explicit
+  disconnect scenarios also passed.
+
+The Journal migration scenarios also start with existing legacy CLI databases.
+The source Rebuild changes its Metadata ID and declares compatibility range
+`4`. A receiving client's legacy Fetch is refused while preserving its local
+Metadata ID and revision and the remote milestone. After selecting NFC, its
+Fetch converges to the source ID and content while preserving the NFD physical
+path. Both plain and independently encrypted ID scenarios passed.
+
+P2P runtime evidence is limited to CLI peers; a real Obsidian P2P peer remains
+unverified. The settings and reconstruction paths are covered by unit tests.
+These checks do not extend NFC support to other hosts or establish native iOS
+or macOS filesystem behaviour.
+
 ## Non-goals
 
 This design does not:
@@ -262,7 +337,7 @@ This design does not:
 - choose among ambiguous NFC-equivalent files or parents, or merge their
   content;
 - change the default away from legacy path identity;
-- enable version `1` for Journal, P2P, Direct file access, WebApp, or an
+- enable version `1` for Direct file access, WebApp, or an
   unverified host adapter; or
 - claim native iOS or macOS filesystem compatibility.
 

docs/recovery.md

@@ -20,13 +20,13 @@ Do not switch transport, enable P2P, or run Garbage Collection as a substitute f
 
 ## Migrate to Unicode NFC path identity
 
-Use this coordinated migration when CLI and Obsidian clients share a CouchDB database and composed and decomposed Unicode spellings should identify the same path. Version `0` remains the default and preserves legacy identity. Version `1` is supported with CouchDB only; it is unsupported with Object Storage and P2P.
+Use this coordinated migration when CLI and Obsidian clients should identify composed and decomposed Unicode spellings as the same path. Version `0` remains the default and preserves legacy identity. CouchDB support is released; Object Storage and P2P support belong to the unreleased extension described in the [Unicode path identity design](design_docs/unicode_path_identity.md).
 
 This migration reconstructs the databases from one authoritative Vault. It does not rewrite document IDs in place or rename files.
 
-1. Update every participating CLI and Obsidian client to a version which supports Unicode NFC path identity. Back up a complete authoritative Vault and the CouchDB database. Stop synchronisation and editing on every device until the migration is complete.
+1. Update every participating CLI and Obsidian client to a version which supports Unicode NFC path identity. Back up a complete authoritative Vault and the selected remote database or Object Storage bucket. For P2P, preserve the participating devices because there is no central remote backup. Stop synchronisation and editing on every device until the migration is complete.
 2. Choose the complete Vault which contains the intended files. Review any composed and decomposed names which would map to the same path identity, and resolve them before reconstruction. If Rebuild or Fetch reports an ambiguous path or Metadata ID, stop and resolve that collision before retrying; LiveSync does not choose or merge the files for you.
-3. On the source client, select **Unicode NFC path identity** (`pathNormalizationVersion: 1`). In Obsidian, choose **Overwrite Server Data with This Device's Files**. In the CLI, set the same value in its settings and run `rebuild` with `--force --write-settings`.
+3. On the source client, open **General Settings** → **File identity** and select **Unicode NFC path identity** (`pathNormalizationVersion: 1`). In Obsidian, choose **Overwrite Server Data with This Device's Files**. In the CLI, set the same value in its settings and run `rebuild` with `--force --write-settings`. For Object Storage, this replaces the remote journals as well as the local database. For P2P, it prepares only the source device's local database; keep that device online for the other devices to Fetch.
 4. On each remaining client, select **Unicode NFC path identity** (`pathNormalizationVersion: 1`) before fetching. In Obsidian, choose **Reset Synchronisation on This Device**. In the CLI, set the same value in its settings and run `fetch` with `--force --write-settings`.
 5. Confirm that every client uses version `1` and that the expected files are present before resuming synchronisation. Do not reconnect a version `0` client to the migrated database.
 

docs/settings.md

@@ -236,6 +236,21 @@ Setting key: showVerboseLog
 
 Show verbose log. Please enable when you report the logs
 
+### 3. File identity
+
+#### Unicode path identity
+
+Setting key: pathNormalizationVersion
+
+Version `0` preserves legacy file identity and is the default for existing and new settings. Version `1` uses Unicode NFC when deriving document IDs, so equivalent composed and decomposed paths identify the same file across the CLI and Obsidian. Existing physical file names are retained. CouchDB support is released. The unreleased extension also supports Object Storage and P2P for the maintained CLI and Obsidian hosts. This is a common local database setting, independently of the active transport.
+
+Version `1` requires a coordinated migration: set it on the source client before Rebuild, then set it on each remaining client before Fetch. Changing the setting alone does not migrate existing Metadata. Follow [Migrate to Unicode NFC path identity](recovery.md#migrate-to-unicode-nfc-path-identity) for the complete procedure. Do not resume a version `0` client against the migrated remote.
+
+The selected value stays pending through ordinary settings saves and reloads. It becomes active only when the Rebuild or Fetch operation is successfully reserved; cancellation leaves it pending.
+
+Distinct files or retained Metadata documents which derive the same identity stop reconstruction before either database is reset. When replacing the local database, Rebuild and Fetch exclude logical deletions without unresolved conflicts; a deleted winner with unresolved conflicts still participates in the check. This check uses the host's supported file listing; Obsidian checks the paths exposed by its Vault APIs and cannot detect physical aliases hidden by its index. Resolve the duplicate names or synchronisation scope first; Self-hosted LiveSync does not merge them automatically. Case-insensitive handling also applies the existing letter-case rule.
+
+
 ## 3. Remote Configuration
 
 ### 1. Connection settings
@@ -1166,17 +1181,6 @@ When this setting is disabled, changing only the letter case of a file name with
 
 New Vaults use case-insensitive handling for cross-platform compatibility. Existing settings with an explicit value preserve that choice. Earlier releases also followed the case-insensitive branch when this value was absent, so 1.0 saves a missing legacy value as `false` without requiring a compatibility review or database rebuild.
 
-#### Unicode path identity
-
-Setting key: pathNormalizationVersion
-
-Version `0` preserves legacy file identity and is the default for existing and new settings. Version `1` uses Unicode NFC when deriving document IDs, so equivalent composed and decomposed paths identify the same file across the CLI and Obsidian. Existing physical file names are retained. This mode currently supports CouchDB only.
-
-Version `1` requires a coordinated migration: set it on the source client before Rebuild, then set it on each remaining client before Fetch. Changing the setting alone does not migrate existing Metadata. Follow [Migrate to Unicode NFC path identity](recovery.md#migrate-to-unicode-nfc-path-identity) for the complete procedure. Do not resume a version `0` client against the migrated remote.
-
-The selected value stays pending through ordinary settings saves and reloads. It becomes active only when the Rebuild or Fetch operation is successfully reserved; cancellation leaves it pending.
-
-Distinct files or retained Metadata documents which derive the same identity stop reconstruction before either database is reset. When replacing the local database, Rebuild and Fetch exclude logical deletions without unresolved conflicts; a deleted winner with unresolved conflicts still participates in the check. This check uses the host's supported file listing; Obsidian checks the paths exposed by its Vault APIs and cannot detect physical aliases hidden by its index. Resolve the duplicate names or synchronisation scope first; Self-hosted LiveSync does not merge them automatically. Case-insensitive handling also applies the existing letter-case rule.
 
 ### 4. Compatibility (Internal API Usage)