fix(sync): converge channel sections across devices on the same identity

[wpfleger96]

Channel-section sidebar state (the sidebar's channel groupings) diverges between a user's dev build and installed DMG on the same identity: sections differ at app open, sometimes self-heal after minutes, sometimes never, and manual "kick" edits inconsistently force convergence. The root cause spans the relay's write-outcome signaling and four client-side sync gaps.

Relay

A NIP-33 parameterized-replaceable coordinate write that lost last-write-wins was reported to the client identically to an idempotent exact-id resubmit — OK true. The losing device recorded its stale content as successfully synced and never refetched, so the two devices stayed diverged.

• Added a ParamReplaceOutcome enum (Inserted / Duplicate / Stale) in crates/buzz-db so the DB layer distinguishes a stored head, an idempotent duplicate (exact-id resubmit or replay of a soft-deleted coordinate), and a strictly-losing Stale write.
• ingest now replies OK false conflict: newer version exists for Stale, so the client refetches the head and converges. Duplicate stays OK true.

Desktop

• Adopt the winner on lost LWW. A local edit that lost whole-blob LWW at pre-publish time was silently republished as remote content while the UI kept showing the edit. The sync manager now adopts the winning remote head — writes it through to React state and localStorage, advances the sync watermark — and skips publishing. This unifies with the relay's OK false conflict path as one convergence mechanism. The pre-publish check compares the fetched head against a canonical (created_at, id) baseline frozen when the edit was queued, not the live watermark, so a remote observed during the debounce window that became head after the edit began is adopted rather than overwritten.
• Durable outbox — never drop an edit. Edits made inside the 2s publish debounce were lost on quit or community switch. A localStorage outbox persists every edit synchronously and resumes it on next mount. Adopt clears the outbox so a superseded edit can never be replayed back into divergence.
• Single-owner pending-edit convergence. Every remote arrival (bootstrap, live, periodic reconcile) defers to a pending local edit whose own debounced publish resolves via publish-or-adopt, so a passive remote can never clobber the optimistic edit or strand its outbox. Publish cycles are serialized — at most one runs at a time; a newer edit queued mid-cycle defers and the in-flight cycle's completion re-drives it — so concurrent generations can never interleave over shared manager state. The per-edit baseline is owned by its generation, and a completing publish folds its own accepted head forward via canonicalMax, so a prior generation's own write is never mistaken for a competing remote and adopted away, and a stale generation cannot sign or publish after a newer edit exists (guarded both after the pre-publish fetch and immediately before signing).
• Canonical equal-timestamp tie-break. Same-second writes from two devices are ordered to match the relay/database (created_at DESC, id ASC — lowest event id wins), so the UI converges on the event the relay actually stored instead of the largest id it happened to see first. This applies uniformly across all four kind-30078 sidebar surfaces that share the comparator — channel sections, stars, mutes, and sort preferences. For the per-entry stores (stars, mutes) the equal-updatedAt remote-wins merge is scoped to the canonical-supersession path only — when a lower-id event corrects an already-applied same-timestamp larger-id head — so a stale value from a superseded larger-id event delivered first cannot survive and undo the winner. Every other application (bootstrap, live, newer timestamp) keeps local-wins merge and does not cancel a pending publish, so a later same-second local click is never clobbered by an older remote entry that decrypts late; strictly-newer local per-entry edits still win.
• Clamp published timestamps. A skewed remote head could push the published created_at past the relay's ±15-minute future-drift window and wedge every later publish. created_at is now clamped inside that window (now + 840s).
• Reconciliation loop. Stale-at-open state waited for a reconnect event a healthy socket never fires. A single scheduler periodically refetches the head (steady 60s, bounded backoff on failure) and refreshes on window visibility, so divergence self-heals without a reconnect.