fix: pin published Commonlib 0.4.2 for deletion recovery

docs/README.md

@@ -29,7 +29,7 @@ Use these references for the area being changed, together with its relevant ADR.
 | Area | References |
 |---|---|
 | Overall synchronisation and terminology | [Technical overview](tech_info.md), [glossary](glossary.md), and [terminology conventions](terms.md) |
-| Recovering unapplied logical deletions | [Deletion recovery design](design_docs/database_to_vault_deletion_recovery.md): accepted implementation design; unreleased, packed-candidate validation |
+| Recovering unapplied logical deletions | [Deletion recovery design](design_docs/database_to_vault_deletion_recovery.md): accepted implementation design; Commonlib 0.4.2 published, application unreleased |
 | File writing, Vault reflection, and recovery ownership | [Write and reflection paths](design_docs/file_write_and_reflection_paths.md): entry policies, completion, retry ownership, and runtime access costs |
 | Metadata, Chunks, and database representations | [Data structures](datastructure.md) |
 | Conflict resolution, provenance, and history restoration | [Conflict and provenance contract](specs_conflict_resolution.md), [Document History restoration](design_docs/document_history_revision_restoration.md), and [local save completion](adr/2026_10_local_file_save_completion_and_batching.md) |

docs/design_docs/database_to_vault_deletion_recovery.md

@@ -2,7 +2,7 @@
 date: 2026-11-10
 commonlib-version: "0.4.1"
 self-hosted-livesync-version: "1.0.47"
-status: accepted; unreleased
+status: accepted; Commonlib published in 0.4.2; application unreleased
 ---
 
 # Recover unapplied database deletions during an ordinary scan
@@ -10,8 +10,11 @@ status: accepted; unreleased
 ## Status and purpose
 
 Accepted on 10 November 2026 after the content-preservation, Fetcher-policy,
-startup integration, and three-file concurrency review. Implementation is complete
-in the local candidate and remains unreleased. The reviewed versions describe the
+startup integration, and three-file concurrency review. Commonlib implementation
+is published in
+[0.4.2](https://github.com/vrtmrz/livesync-commonlib/releases/tag/0.4.2).
+The Obsidian integration consumes that exact registry version and remains
+unreleased. The reviewed versions describe the
 baseline, not a release containing this recovery. Historical review findings and measured
 baseline calls remain below; implementation verification is tracked separately.
 
@@ -541,17 +544,17 @@ retain the file, and do not claim remote absence. Exceptions retain their phase
 and diagnostic cause. This conservative result avoids changing existing Chunk
 retrieval semantics or adding a second retry policy.
 
-The implementation is prepared against an exact local packed Commonlib artefact.
-Publication and replacement with an immutable registry dependency are separate
-release operations. Local candidate validation must identify the packed bytes;
-it does not establish registry availability or iPhone performance.
+The implementation was prepared against an exact local packed Commonlib artefact.
+The application now pins registry Commonlib 0.4.2 and its integrity. Registry
+validation establishes the published bytes; it does not establish iPhone performance.
 
 
 ## Implementation and publication status
 
 The guarded handler, opt-in provenance enumeration, cleanup discovery, shared
 three-file admission, and ordered scanner bookkeeping are implemented in the
-unreleased Commonlib source candidate. The Obsidian host enables the capability.
+published Commonlib 0.4.2 package. The unreleased Obsidian host integration enables
+the capability.
 The reviewed-version frontmatter remains the published baseline, not a claim
 that registry Commonlib 0.4.1 includes this change.
 
@@ -559,5 +562,7 @@ Owner tests establish the two-body-read path and preservation/restart contracts
 through real local revision storage with injected host boundaries. Packed-package
 checks validate the candidate independently. Real Obsidian restart validation and
 consumer checks use those same packed bytes; physical iPhone timing and peak
-memory remain separate evidence. A releasing application must replace the local
-candidate with the exact published immutable Commonlib version and integrity.
+memory remain separate evidence. The application dependency now selects that
+exact published immutable Commonlib
+version and integrity. Application release and physical iPhone measurements remain
+separate follow-ups.

package-lock.json

@@ -23,7 +23,7 @@
                 "@smithy/types": "^4.14.3",
                 "@smithy/util-retry": "^4.4.5",
                 "@vrtmrz/browser-ui-kit": "0.1.0",
-                "@vrtmrz/livesync-commonlib": "file:.local-packages/vrtmrz-livesync-commonlib-issue1338.tgz",
+                "@vrtmrz/livesync-commonlib": "0.4.2",
                 "@vrtmrz/obsidian-plugin-kit": "0.1.7",
                 "@vrtmrz/ui-interactions": "0.1.2",
                 "@vrtmrz/value-store": "0.1.0",
@@ -4081,9 +4081,9 @@
             }
         },
         "node_modules/@vrtmrz/livesync-commonlib": {
-            "version": "0.4.1",
-            "resolved": "file:.local-packages/vrtmrz-livesync-commonlib-issue1338.tgz",
-            "integrity": "sha512-B/ydrJngdEz0z4ZcWkFGb1R5gjZ4Rwp5vE6ABWhguwkPA3G6572O/iT5GfarnrjDggFkUi86/bcXTh1yG8u0Vg==",
+            "version": "0.4.2",
+            "resolved": "https://registry.npmjs.org/@vrtmrz/livesync-commonlib/-/livesync-commonlib-0.4.2.tgz",
+            "integrity": "sha512-Wp5Orssnzm9vO36CB4+IK0Z19ULBZ+A7Mzm4NP7GgPce2rCCDzeS9m5zIenPtgz/xG2eF/T0Ni+5AWfs/ERALQ==",
             "license": "MIT",
             "dependencies": {
                 "@aws-crypto/sha256-js": "5.2.0",

package.json

@@ -214,7 +214,7 @@
         "@smithy/types": "^4.14.3",
         "@smithy/util-retry": "^4.4.5",
         "@vrtmrz/browser-ui-kit": "0.1.0",
-        "@vrtmrz/livesync-commonlib": "file:.local-packages/vrtmrz-livesync-commonlib-issue1338.tgz",
+        "@vrtmrz/livesync-commonlib": "0.4.2",
         "@vrtmrz/obsidian-plugin-kit": "0.1.7",
         "@vrtmrz/ui-interactions": "0.1.2",
         "@vrtmrz/value-store": "0.1.0",