fix(sync): converge channel sections across devices on the same identity

[wpfleger96]

Channel-section sidebar state (the sidebar's channel groupings) diverges between a user's dev build and installed DMG on the same identity: sections differ at app open, sometimes self-heal after minutes, sometimes never, and manual "kick" edits inconsistently force convergence. The root cause spans the relay's write-outcome signaling and four client-side sync gaps.

Relay

A NIP-33 parameterized-replaceable coordinate write that lost last-write-wins was reported to the client identically to an idempotent exact-id resubmit — OK true. The losing device recorded its stale content as successfully synced and never refetched, so the two devices stayed diverged.

• Added a ParamReplaceOutcome enum (Inserted / Duplicate / Stale) in crates/buzz-db so the DB layer distinguishes a stored head, an idempotent duplicate (exact-id resubmit or replay of a soft-deleted coordinate), and a strictly-losing Stale write.
• ingest now replies OK false conflict: newer version exists for Stale, so the client refetches the head and converges. Duplicate stays OK true.

Desktop

• Adopt the winner on lost LWW. A local edit that lost whole-blob LWW at pre-publish time was silently republished as remote content while the UI kept showing the edit. The sync manager now adopts the winning remote head — writes it through to React state and localStorage, advances the sync watermark — and skips publishing. This unifies with the relay's OK false conflict path as one convergence mechanism. The pre-publish check compares the fetched head against a canonical (created_at, id) baseline frozen when the edit was queued, not the live watermark, so a remote observed during the debounce window that became head after the edit began is adopted rather than overwritten.
• Durable outbox — never drop an edit. Edits made inside the 2s publish debounce were lost on quit or community switch. A localStorage outbox persists every edit synchronously and resumes it on next mount. Adopt clears the outbox so a superseded edit can never be replayed back into divergence.
• Single-owner pending-edit convergence. Every remote arrival (bootstrap, live, periodic reconcile) defers to a pending local edit whose own debounced publish resolves via publish-or-adopt, so a passive remote can never clobber the optimistic edit or strand its outbox. Each pending edit carries a monotonic generation; a publish completion clears pending/outbox/retry state only via compare-and-swap on the generation it published, so an older in-flight publish cannot erase a newer edit queued mid-flight.
• Canonical equal-timestamp tie-break. Same-second writes from two devices are ordered to match the relay/database (created_at DESC, id ASC — lowest event id wins), so the UI converges on the event the relay actually stored instead of the largest id it happened to see first. This applies uniformly across all four kind-30078 sidebar surfaces that share the comparator — channel sections, stars, mutes, and sort preferences. For the per-entry stores (stars, mutes) the merge step also resolves an equal per-entry updatedAt toward the canonical incoming event, so a stale value from a superseded larger-id event delivered first cannot survive and undo the winner; strictly-newer local per-entry edits still win.
• Clamp published timestamps. A skewed remote head could push the published created_at past the relay's ±15-minute future-drift window and wedge every later publish. created_at is now clamped inside that window (now + 840s).
• Reconciliation loop. Stale-at-open state waited for a reconnect event a healthy socket never fires. A single scheduler periodically refetches the head (steady 60s, bounded backoff on failure) and refreshes on window visibility, so divergence self-heals without a reconnect.