How should local-first sync resolve conflicts between phone and device?

Define conflict rules per field: device, app, or server wins, and never silently merge safety limits. Timestamp last-write-wins is fragile across clock drift, so prefer version vectors or monotonic device epochs. For example, let a gateway keep a verified temperature cutoff while the app asks the user to resolve a renamed room after reconnect.