Problem
Ledger reconciliation between the tracked ledger and the store must not silently delete records that exist on only one surface.
Observed (external): cloister (github.com/agentic-research/cloister) reconciles its tracked bead ledger against the store as a union: fresh store state wins where both have a record, published-but-store-lost records are preserved and recovered, and the reason is recorded on the record rather than rewriting status silently.
Interpretation: Ledger reconciliation (and Vault maintenance) should adopt the same discipline: never drop a published record; record the reason; union semantics with explicit conflict resolution (fresh state wins where both exist).
Proposed change
- Define reconciliation as union: preserved if present on either surface; reason recorded per recovered/overridden record.
- Add a reconciliation dry-run report listing records that would be dropped by any current code path.
- Never auto-delete a published-but-lost record without an explicit operator flag.
Acceptance criteria
- Dry-run reconciliation surfaces all would-be drops before any mutation.
- A record present only in the tracked ledger is preserved and its recovery reason is recorded.
- A record present only in the store is preserved.
- No silent status rewrite: every divergence records its resolution reason.
- Unit tests for both one-sided cases and the both-sides conflict case.
Grounding
Problem
Ledger reconciliation between the tracked ledger and the store must not silently delete records that exist on only one surface.
Observed (external): cloister (github.com/agentic-research/cloister) reconciles its tracked bead ledger against the store as a union: fresh store state wins where both have a record, published-but-store-lost records are preserved and recovered, and the reason is recorded on the record rather than rewriting status silently.
Interpretation: Ledger reconciliation (and Vault maintenance) should adopt the same discipline: never drop a published record; record the reason; union semantics with explicit conflict resolution (fresh state wins where both exist).
Proposed change
Acceptance criteria
Grounding