Reject conflicting SSH sync metadata

docs/architecture.md

@@ -223,11 +223,13 @@ unsupported and asks for JSONL or the spec source. Revocation lists are not yet
 full CRDT-replicated resources, but the daemon can already pull cert-flow and
 revocation metadata from authorized peers over the protected Iroh control ALPN.
 Manual sync commands and the background live-sync loop share the same capability
-checks and cursor state. Local SSH certificate and revocation metadata commands
-also accept an optional subject principal for authorization testing: non-owner
-subjects must hold `ssh_cert.*` capabilities on `resource:ssh:certs` or
-`ssh_revocation.*` capabilities on `resource:ssh:revocations` before requests,
-approval/import/read operations, or revocation publish/read/import operations
+checks and cursor state. Sync import rejects conflicting records with ids that
+already exist locally instead of replacing local metadata. Local SSH certificate
+and revocation metadata commands also accept an optional subject principal for
+authorization testing: non-owner subjects must hold `ssh_cert.*` capabilities on
+`resource:ssh:certs` or `ssh_revocation.*` capabilities on
+`resource:ssh:revocations` before requests, approval/import/read operations, or
+revocation publish/read/import operations
 are accepted. The live-sync loop first asks for authorized stream watermarks and
 skips module pulls whose remote high-water value has not advanced.
 

docs/roadmap.md

@@ -264,8 +264,12 @@ resource-scoped capability decisions.
     `ssh_revocation.import` for explicit non-owner `--subject` principals.
   - `[x]` Tests cover denied and granted non-owner local SSH cert request and
     revocation publish flows.
+  - `[x]` Sync import rejects conflicting certificate request, certificate, and
+    revocation records with ids that already exist locally.
+  - `[x]` Tests verify conflicting SSH cert request and revocation records do
+    not overwrite local metadata.
   - `[ ]` Future completion requires all accepted SSH cert/revocation records
-    to be signed and reducible before replication.
+    to carry signed provenance and reduce cleanly before replication.
 
 ## Phase 3: CAS, KV, And Pubsub
 
@@ -400,7 +404,10 @@ Goal: add authorized stream-oriented management workflows over Iroh.
   - `[x]` Background live-sync uses the same protected Iroh path and cursor
     state as manual sync.
   - `[ ]` Replace pull-only metadata sync with a resource log or CRDT model.
-  - `[ ]` Conflicting or unsigned records are rejected or quarantined.
+  - `[x]` Conflicting records with already-known ids are rejected during import
+    rather than replacing local metadata.
+  - `[ ]` Unsigned records are rejected or quarantined once signed provenance is
+    part of the metadata format.
 
 - `[x]` OpenSSH KRL import/export.
   Acceptance criteria: