content: trust-gated federation + conflict tests (Phase 4 complete, roadmap done, 230/230)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/content-on-sx.md

@@ -19,7 +19,7 @@ injected adapter, not core.
 
 ## Status (rolling)
 
-`bash lib/content/conformance.sh` → **210/210** (Phases 1–3 complete + Phase 4 Ghost adapter)
+`bash lib/content/conformance.sh` → **230/230** (Phases 1–4 COMPLETE: blocks, doc, render, api, persist op log, CRDT merge, Ghost sync, federation)
 
 ## Ground rules
 
@@ -72,11 +72,19 @@ lib/content/api.sx ── (content/edit) (content/render) (content/history) ─
 
 ## Phase 4 — External sync + federation
 - [x] Ghost/CMS sync via injected adapter (import/export)
-- [ ] federated documents (peer-authored blocks) — trust-gated stub
-- [~] tests: round-trip import/export (done), conflict on concurrent external edit (pending)
+- [x] federated documents (peer-authored blocks) — trust-gated stub
+- [x] tests: round-trip import/export, conflict on concurrent external edit
 
 ## Progress log
 
+- 2026-06-07 — Phase 4 `fed.sx` (**Phase 4 COMPLETE — roadmap done**):
+  trust-gated federation. Peer ops carry provenance (`:author`, `:sig` stub);
+  none are auto-accepted. The trust gate is a pluggable predicate (acl-on-sx
+  hook) with a trusted-actor-list convenience stub. `content/merge-peer[-with]`
+  applies only accepted ops through the CvRDT and quarantines the rest
+  (`{:state :accepted :rejected}`). Concurrent local/external edits reconcile
+  deterministically: same-field LWW by (ts,actor), commutative, idempotent;
+  untrusted ops never touch state. 20 tests; suite 230/230.
 - 2026-06-07 — Phase 4 `sync.sx` (cb1): external CMS sync via an injected
   adapter. Core defines the shape — `{:import :export}` — and delegates;
   `content/import` / `content/export` / `content/round-trip` know nothing about