Pin the hold queue counts and its not-found answers
Enforce the storage-version gate: refuse to sync across a breaking manifest change
Expose the dead-letter hold to consumers
Hold unappliable remote changes instead of losing them at the cursor