Deploy identity drift reconciliation

docs/user-engine-enterprise-identity-extension-points.md

@@ -85,3 +85,21 @@ Enterprise implementation begins only when a named tenant supplies:
 - test tenant and rollback owner.
 
 Until then, local LLDAP plus KeyCape remains the managed identity path.
+
+## Provider reconciliation contract
+
+The local LLDAP adapter establishes the provider-neutral operational pattern
+that later enterprise adapters must preserve:
+
+- `drift` performs a read-only comparison of desired identity, tenant groups,
+  roles, and lifecycle status;
+- `reconcile` converges only adapter-owned attributes and reports every change;
+- ambiguous email/subject conflicts fail for explicit repair instead of
+  silently relinking an identity;
+- newly created identities are compensated when initial group projection
+  cannot complete;
+- deprovisioning is replay-safe, and transient transport failures may be
+  retried only with the caller's required idempotency key.
+
+SCIM and directory-synchronization adapters should implement this same seam
+instead of adding provider-specific repair behavior to user-engine.