Sync: durable edits

A Sync edit is the user's intent, stored before it is sent, so its failures are different from a mutation's. See When things go wrong.

• Offline is not a failure. Edits keep applying and keep being saved; status.pending grows, and the exchange retries on a backoff. A failed exchange sets status.lastError (cleared by the next success) and reports ExchangeFailed.
• A rejected edit arrives on the next exchange, not as an error. The replica drops it from the outbox and replays the rest, and the field reverts. status.rejected lists it with the operation and a reason: the authorize rule's own words when it gave some, Refused by the server when it refused without any (a plain false), and Not a valid operation when the operation itself failed (validate refused or threw, authorize threw, or the reducer could not apply it). An error's message is never sent.
• A persist that fails reverts the edit and calls onPersistenceFailure, whose returned Model is what the reader sees next. The reader must redo it.
• The outbox is user data, not a cache. Edits not yet committed live only there. Deleting local storage to "fix" a replica deletes them; evicted storage loses them the same way.