When things go wrong

Each case is designed, not incidental. The ones that change how you build the application come first.

• The network is gone. Edits keep applying and keep being saved. pending grows; the loop retries. Nothing to handle.
• The server rejects an edit. Dropped from pending, the rest replayed, the Model re-installed. Explain it from status.rejected.
• The page unloads before the persist finishes. The browser asks first; leaving anyway loses the edits not yet stored.
• The persist fails. The edit is reverted and onPersistenceFailure runs. The user has to redo it.
• Local storage was evicted. The replica starts at cursor 0 and catches up from the server, but edits that lived only in the outbox are gone. The outbox is user data, not a cache.
• Two tabs share one storage name. Compare-and-swap fails the stale writer with StorageError. Give each tab its own name and ReplicaId.
• The replica is far behind. The server may answer in pages (more), and synchronize asks again at once until caught up. If the server compacted the history it needs, it sends a checkpoint instead: a snapshot and cursor the replica adopts as its base before replaying its pending edits. A checkpoint behind the replica's cursor is refused (CheckpointRegressionError), never applied backwards.
• The server lost its history. A server names its history with an epoch; a replica that hears a new one rebuilds its committed state from that answer and resends its outbox. Everything the old server committed is gone on every replica. A replica that never heard an epoch cannot tell, and fails every exchange until its storage is cleared.
• Stored state is from another version. Opening fails with UnsupportedReplicaVersionError naming both versions; the bytes are left for a deliberate migration or reset. Sync versions its own envelope only; your Message and snapshot migrations stay yours.
• The server answers nonsense. Malformed exchanges, gaps in the committed order, acknowledgements or rejections for operations the replica never sent: each fails the exchange rather than touch local work.