[vrtmrz]

This fix lets an opted-in host recover received logical deletions during an ordinary scan while preserving files whose unchanged contents cannot be established.

Related to vrtmrz/obsidian-livesync#1338. A deletion may reach the database while its Vault file remains present; the existing ordinary scan did not retry that reflection.

Behaviour and cost

• Reuse the ordinary scan collection and verify the current deletion, conflicts, provenance, and file contents before removal. Recovery creates no Metadata revision or conflict branch.
• Share three recovery permits, acquired before document locks and body reads. Legacy content retrieval follows the existing Fetcher policy, including remote delivery and suppression.
• Confirm physical absence separately from provenance cleanup, and rediscover interrupted cleanup from existing provenance keys and last-seen entries. Coalesce bookkeeping and await the final ordered flush.
• Keep enumeration opt-in and keys-only. Correct unbounded namespaced key enumeration, including Unicode paths, while retaining explicit range/count behaviour.
• Split offline scanner responsibilities behind its existing facade; document decisions, coherent result subtypes, and public contracts.

Verification

• Commonlib unit coverage: 190 files, 3,659 tests passed; deletion handler: 54 tests, 98.29% line and 92.45% branch coverage.
• Type, boundary, and independent packed-package consumer checks passed.
• The exact packed candidate passed LiveSync checks/build, 2,089 unit tests (one skipped), and real Obsidian 1.12.7 arm64 restart E2E, including unchanged deletion, same-stat edit preservation, unknown-content preservation, and unchanged Metadata history.
• Regression tests establish the original scanner failure and the stored-versus-resolved path failure before the corresponding fixes. Timestamp boundary tests distinguish host freshness from revision identity.

Physical iPhone performance and Android-specific timestamp precision remain unmeasured. External edits after the final observation are outside the non-transactional storage guarantee. The initial iPhone reflection failure reported in the issue has not been reproduced; this change supplies the guarded recovery path.

The package is not yet published. The consumer will need an immutable published version before release.