Reject conflicting SSH sync metadata

docs/roadmap.md

@@ -264,8 +264,12 @@ resource-scoped capability decisions.
     `ssh_revocation.import` for explicit non-owner `--subject` principals.
   - `[x]` Tests cover denied and granted non-owner local SSH cert request and
     revocation publish flows.
+  - `[x]` Sync import rejects conflicting certificate request, certificate, and
+    revocation records with ids that already exist locally.
+  - `[x]` Tests verify conflicting SSH cert request and revocation records do
+    not overwrite local metadata.
   - `[ ]` Future completion requires all accepted SSH cert/revocation records
-    to be signed and reducible before replication.
+    to carry signed provenance and reduce cleanly before replication.
 
 ## Phase 3: CAS, KV, And Pubsub
 
@@ -400,7 +404,10 @@ Goal: add authorized stream-oriented management workflows over Iroh.
   - `[x]` Background live-sync uses the same protected Iroh path and cursor
     state as manual sync.
   - `[ ]` Replace pull-only metadata sync with a resource log or CRDT model.
-  - `[ ]` Conflicting or unsigned records are rejected or quarantined.
+  - `[x]` Conflicting records with already-known ids are rejected during import
+    rather than replacing local metadata.
+  - `[ ]` Unsigned records are rejected or quarantined once signed provenance is
+    part of the metadata format.
 
 - `[x]` OpenSSH KRL import/export.
   Acceptance criteria: