Stop a finished push deleting the edit made while it was in flight, and pull a newly synced type from the start

- The outbox coalesces a new save into the row a push already read, under a new operation id, but
  Complete, Revise and Park found the row by sequence alone. The acknowledgement of the earlier state
  deleted the row holding the later one and the edit was gone without a word. They now take the
  PendingOperation and act only while the row still holds it; a later edit is rebased onto the version
  just accepted, so it pushes cleanly instead of conflicting with its own earlier save.
- A pull filtered by type moves the cursor past changes of types it did not ask for, so a build that
  added a type (SpelunkKey, ObjectStore) never received the items of that type made before it.
  sync_state.pulled_types records the list a cursor was read under, and a different list starts the
  pull over once. Migration AddSyncStatePulledTypes.

src/DodoSSH.Client.Sync/SyncEngine.cs

@@ -127,7 +127,7 @@ public sealed class SyncEngine
         SyncReportBuilder report,
         CancellationToken cancellationToken)
     {
-        var state = await syncState.ReadAsync(vaultId, cancellationToken).ConfigureAwait(false);
+        var state = await ReadStateAsync(vaultId, report, cancellationToken).ConfigureAwait(false);
 
         // At most one restart per pull. A server that rejects the cursor it has just issued is not
         // telling this client anything it can act on, and replaying the whole log against it would turn
@@ -245,6 +245,26 @@ public sealed class SyncEngine
     /// the beginning as well, rather than meeting the same refusal again.
     /// </para>
     /// </remarks>
+    /// <summary>Where the pull should carry on from, which is the start when the types it reads have changed.</summary>
+    /// <remarks>
+    /// A cursor read under a different list of types is past changes of the types it did not ask for, so an
+    /// upgrade that adds one — SpelunkKey, ObjectStore — would never receive the items of that type made
+    /// before it. Starting over once is the only way to see them; applying is idempotent, which is what makes
+    /// the restart for a refused cursor safe as well. A state from before the list was kept has none and
+    /// starts over once for the same reason: it may already have missed some.
+    /// </remarks>
+    private async Task<StoredSyncState> ReadStateAsync(
+        Guid vaultId,
+        SyncReportBuilder report,
+        CancellationToken cancellationToken)
+    {
+        var state = await syncState.ReadAsync(vaultId, cancellationToken).ConfigureAwait(false);
+
+        return state.Cursor is not null && !string.Equals(state.PulledTypes, PulledTypes, StringComparison.Ordinal)
+            ? await StartOverAsync(state, report, cancellationToken).ConfigureAwait(false)
+            : state;
+    }
+
     private async Task<StoredSyncState> StartOverAsync(
         StoredSyncState state,
         SyncReportBuilder report,
@@ -282,9 +302,14 @@ public sealed class SyncEngine
             KeyGeneration = response.CurrentKeyGeneration,
             LastPulledAt = now,
             ServerTimeSkewMs = skew,
+            PulledTypes = PulledTypes,
         };
     }
 
+    /// <summary>The types this build pulls, in a form a stored state can be compared against.</summary>
+    private static string PulledTypes { get; } =
+        string.Join(',', ItemKinds.SyncedTypes.Select(type => (int)type).Order());
+
     private async Task ApplyAsync(
         Guid vaultId,
         SyncChange change,
@@ -446,7 +471,7 @@ public sealed class SyncEngine
         }
 
         await outbox.ReviseAsync(
-                operation.Sequence,
+                operation,
                 operation.Operation,
                 operation.ExpectedVersion,
                 resealed,
@@ -551,7 +576,76 @@ public sealed class SyncEngine
                 cancellationToken).ConfigureAwait(false);
         }
 
-        await outbox.CompleteAsync(operation.Sequence, cancellationToken).ConfigureAwait(false);
+        var completed = await outbox.CompleteAsync(operation, cancellationToken).ConfigureAwait(false);
+
+        if (!completed && canMirror && !isDelete)
+        {
+            await RebaseOntoAcceptedAsync(vaultId, operation, version, cancellationToken).ConfigureAwait(false);
+        }
+    }
+
+    /// <summary>
+    /// Moves an edit made while <paramref name="accepted"/> was in flight onto the version that push produced.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// The user saved again between the push being read and its answer arriving, so the row now holds a
+    /// later state branched from the same base as the one the server just took. Left alone it is still the
+    /// user's edit and still goes — but it goes expecting the old version, comes back <c>Conflict</c>, and is
+    /// merged against an ancestor that predates the save the server already has, which makes every field
+    /// changed twice look like a disagreement with somebody else. Its true parent is the state just accepted,
+    /// so that becomes its ancestor and expected version, and its payload is re-sealed at the version it
+    /// will now produce, because the AAD binds that.
+    /// </para>
+    /// <para>
+    /// Only for a row still branched from the same base. One that is not has been revised by something else
+    /// since, and the ordinary conflict path is the one that knows what to do with it; so is a row whose
+    /// payload this session cannot re-seal.
+    /// </para>
+    /// </remarks>
+    private async Task RebaseOntoAcceptedAsync(
+        Guid vaultId,
+        PendingOperation accepted,
+        int version,
+        CancellationToken cancellationToken)
+    {
+        var later = await outbox
+            .FindAsync(vaultId, accepted.EntityType, accepted.EntityId, cancellationToken)
+            .ConfigureAwait(false);
+
+        if (later is null || later.ExpectedVersion != accepted.ExpectedVersion || accepted.Payload is null)
+        {
+            return;
+        }
+
+        EncryptedPayload? payload = null;
+
+        if (later.Payload is { } queued)
+        {
+            payload = PayloadReseal.TryReseal(
+                keyring,
+                vaultId,
+                later.EntityType,
+                later.EntityId,
+                queued,
+                openAtVersion: SyncVersions.NextVersion(later.ExpectedVersion),
+                sealAtVersion: SyncVersions.NextVersion(version));
+
+            if (payload is null)
+            {
+                return;
+            }
+        }
+
+        await outbox.ReviseAsync(
+                later,
+                later.Operation,
+                version,
+                payload,
+                later.Fields,
+                new StoredAncestor(version, accepted.Payload, accepted.Fields),
+                cancellationToken)
+            .ConfigureAwait(false);
     }
 
     private async Task<bool> ResolveAsync(
@@ -617,7 +711,7 @@ public sealed class SyncEngine
         if (operation.Operation == SyncOperation.Delete)
         {
             // Nothing there to delete, so the intent is already satisfied.
-            await outbox.CompleteAsync(operation.Sequence, cancellationToken).ConfigureAwait(false);
+            await outbox.CompleteAsync(operation, cancellationToken).ConfigureAwait(false);
             return false;
         }
 
@@ -645,7 +739,7 @@ public sealed class SyncEngine
         SyncReportBuilder report,
         CancellationToken cancellationToken)
     {
-        await outbox.ParkAsync(operation.Sequence, reason, cancellationToken).ConfigureAwait(false);
+        await outbox.ParkAsync(operation, reason, cancellationToken).ConfigureAwait(false);
 
         await conflicts.RecordAsync(
             vaultId,