[merryman]

Extend ChangeManager and UndoManager with synchronous atomic transactions and exact replay. Supported morph edits can commit as one undoable unit or recover their captured state when a mutation or reaction fails.

• transaction(opts, fn) captures property, structural and typed text operations before their effects, including partially failing primitives. Nested transactions provide savepoints. Complete rollback rethrows the original error by identity; incomplete recovery reports MorphicRollbackError. A caught incomplete nested rollback prevents the outer transaction from committing.
• applyChangeSet replays without creating history. Synchronous reactions run normally; their writes are journaled, repaired and verified against the intended state. Value snapshots preserve mutable graphics values, container prototypes, own __proto__ fields, sparse arrays and symbol keys.
• Text operations retain compact range content, attributes, selection and embedded-morph recovery data. Exact replay of the full-text listener view requires its matching receipt and rejects missing receipts before mutation.
• Commit tokens and replaceRecordedChanges preserve chronological history ownership. compensate reverses rejected committed work exactly once; abortGroup reverses an owned active group without a redo entry. performEdit enlists domain edits with recovery receipts.
• Detached-object handles track retention across history replacement, pruning and clearing. Per-node disposal receipts support idempotent cleanup under a caller-supplied policy. historyStats() reports retained objects and estimated payload; clearHistory() releases history handles. Attached objects are never disposed.

Committed listeners receive one delivery after a successful outer transaction and none after rollback. Synchronous onChange observers can see intermediate writes and their inverses. Metadata callbacks propagate exceptions after restoring their scope. Existing recording batches retain their non-atomic behavior, and caller adoption remains opt-in.

Transactions cannot span asynchronous work. Returning a thenable rolls back synchronously and throws MorphicTransactionAsyncError; later continuations run outside that transaction. The state guard rejects direct state-object writes, while slot replacement and retained shallow aliases are checked at scope exit. Deep alias mutations, never-enlisted morphs, uninstrumented document methods, arbitrary DOM/JavaScript state and external effects remain outside the guarantee.

Browser regressions cover savepoints, partial failures, late-enlisted guards, reaction recovery, text and embedded morphs, history ownership, domain receipts and retained-object lifetimes. Focused transaction/foundation tests pass, including snapshot regressions that fail without the own-key correction.

Refs #104: this supplies the change foundation; world-level direct-manipulation adoption and the CRDT experiment remain open.